October 2014 - tor-commits - lists.torproject.org

[tor/master] fix some typos in the man page
by arma＠torproject.org 04 Oct '14

04 Oct '14

commit 22a0708133f09d8703b3c64edfc55b5cdf904976 Author: Roger Dingledine <arma(a)torproject.org> Date: Sat Oct 4 15:41:05 2014 -0400 fix some typos in the man page --- doc/tor.1.txt | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/doc/tor.1.txt b/doc/tor.1.txt index ff17819..957c6d1 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -964,10 +964,10 @@ The following options are useful only for clients (that is, if (SOCKS 4, SOCKS 5, TransPort connections, NATDPort connections, and DNSPort requests are all considered to be different protocols.) **IsolateDestPort**;; - Don't share circuits with streams targetting a different + Don't share circuits with streams targeting a different destination port. **IsolateDestAddr**;; - Don't share circuits with streams targetting a different + Don't share circuits with streams targeting a different destination address. **SessionGroup=**__INT__;; If no other isolation rules would prevent it, allow streams @@ -1018,7 +1018,7 @@ The following options are useful only for clients (that is, if requests via this connection. **PreferIPv6Automap**;; When serving a hostname lookup request on this port that - should get automapped (according to AutomapHostsOnResove), + should get automapped (according to AutomapHostsOnResolve), if we could return either an IPv4 or an IPv6 answer, prefer an IPv6 answer. (On by default.) **PreferSOCKSNoAuth**;; @@ -1425,7 +1425,7 @@ The following options are useful only for clients (that is, if whose view of the current time is skewed. If this option is set to 0, we do not send this timestamp, and hidden services on obsolete Tor versions will not work. If this option is set to 1, we send the timestamp. If - this optoin is "auto", we take a recommendation from the latest consensus + this option is "auto", we take a recommendation from the latest consensus document. (Default: auto) @@ -2032,7 +2032,7 @@ The following options are used to configure a hidden service. [[HiddenServicePort]] **HiddenServicePort** __VIRTPORT__ [__TARGET__]:: Configure a virtual port VIRTPORT for a hidden service. You may use this option multiple times; each time applies to the service using the most - recent hiddenservicedir. By default, this option maps the virtual port to + recent HiddenServiceDir. By default, this option maps the virtual port to the same port on 127.0.0.1 over TCP. You may override the target port, address, or both by specifying a target of addr, port, or addr:port. You may also have multiple lines with the same VIRTPORT: when a user

1 0

r26967: {website} add new mirror (website/trunk/include)
by Andrew Lewman 04 Oct '14

04 Oct '14

Author: phobos Date: 2014-10-04 02:14:32 +0000 (Sat, 04 Oct 2014) New Revision: 26967 Modified: website/trunk/include/tor-mirrors.csv Log: add new mirror Modified: website/trunk/include/tor-mirrors.csv =================================================================== --- website/trunk/include/tor-mirrors.csv 2014-10-04 01:59:07 UTC (rev 26966) +++ website/trunk/include/tor-mirrors.csv 2014-10-04 02:14:32 UTC (rev 26967) @@ -91,3 +91,4 @@ admin AT nuclear DASH weapons DOT net, Setec Administrator, US, Texas, Austin, TRUE, FALSE, No, http://tor.nuclear-weapons.net, https://tor.nuclear-weapons.net, , , http://tor.nuclear-weapons.net/dist,, https://tor.nuclear-weapons.net/dist, , Mon Sep 29 23:44:59 2014 0x43DE8191, Tor Supporter, DE, Germany, Europe, TRUE, TRUE, No, http://torproject.hactar.bz, , , , http://torproject.hactar.bz/dist/, , , , Mon Sep 29 23:44:59 2014 -nick at calyx dot com, The Calyx Institute, US, United States, North America, TRUE, FALSE, No, http://tor.calyxinstitute.org, https://tor.calyxinstitute.org, , , http://tor.calyxinstitute.org/dist/, https://tor.calyxinstitute.org/dist/, , http://tmdrhl4e4anhsjc5.onion, +opi(a)zeropi.net, Tor Supporter, FR, France, FR, TRUE, TRUE, No,http://tor-mirror.zeropi.net/, , , ,http://tor-mirror.zeropi.net/dist/, , , , \ No newline at end of file

1 0

r26966: {website} fix nuclear-weapons.net (website/trunk/include)
by Andrew Lewman 04 Oct '14

04 Oct '14

Author: phobos Date: 2014-10-04 01:59:07 +0000 (Sat, 04 Oct 2014) New Revision: 26966 Modified: website/trunk/include/tor-mirrors.csv Log: fix nuclear-weapons.net Modified: website/trunk/include/tor-mirrors.csv =================================================================== --- website/trunk/include/tor-mirrors.csv 2014-10-02 01:17:04 UTC (rev 26965) +++ website/trunk/include/tor-mirrors.csv 2014-10-04 01:59:07 UTC (rev 26966) @@ -1,24 +1,24 @@ adminContact, orgName, isoCC, subRegion, region, ipv4, ipv6, loadBalanced, httpWebsiteMirror, httpsWebsiteMirror, rsyncWebsiteMirror, ftpWebsiteMirror, httpDistMirror, httpsDistMirror, rsyncDistMirror, hiddenServiceMirror, updateDate -Tor Fan, Tor Supporter, US, United States, US, TRUE, TRUE, No, http://tor.loritsu.com/, , , , http://tor.loritsu.com/dist/, , , , -Tor Fan, Tor Supporter, LU, Luxemborg, LU, TRUE, FALSE, No, http://torproject.adamas.ai/, , , , http://torproject.adamas.ai/dist/, , , , -Tor Fan, Tor Supporter, UA, Ukraine, UA, TRUE, FALSE, No, http://torua.reactor-xg.kiev.ua/, , , , http://torua.reactor-xg.kiev.ua/dist/, , , , -Tor Fan, Tor Supporter, FR, France, FR, TRUE, FALSE, No, http://37.187.0.127/tormirror/, , , , http://37.187.0.127/tormirror/dist/, , , , -Tor Fan, Tor Supporter, US, United States, US, TRUE, FALSE, No, http://tor.minibofh.org/, , , , http://tor.minibofh.org/dist/, , , , -Tor Fan, Tor Supporter, UK, United Kingdom, UK, TRUE, FALSE, No, http://tor.mage.me.uk/, , , , http://tor.mage.me.uk/dist/, , , , -nsane2307 eml cc, tor-mirror.de, DE, Germany, Europe, TRUE, FALSE, No, http://tor-mirror.de/, https://tor-mirror.de/, , , http://tor-mirror.de/dist/, https://tor-mirror.de/dist/, , , -citizen428 AT gmail DOT com, [[:bbs:]], DE, Germany, Europe, TRUE, FALSE, No, http://tor.blingblingsquad.net/, https://tor.blingblingsquad.net/, , , http://tor.blingblingsquad.net/dist/, https://tor.blingblingsquad.net/dist/, , , -Tor Fan, Tor Supporter, US, United States, US, TRUE, FALSE, No, , , , , http://www.netgull.com/torproject/, , , , -Tor Fan, NW Linux, US, WA, US, TRUE, FALSE, No, http://torproject.nwlinux.us/, , rsync://nwlinux.us/tor-web, , http://torproject.nwlinux.us/dist/, , rsync://nwlinux.us/tor-dist, , -Tor Fan, Tor Supporter, NL, The Netherlands, NL, TRUE, FALSE, No, , , , , , https://www.coevoet.nl/tor/dist/, , , -Tor Fan, LazyTiger, FR, France, FR, TRUE, FALSE, No, http://tor.taiga-san.net/, , , , http://tor.taiga-san.net/dist/, , , , -Tor Fan, Tor Supporter, EE, Estonia, EE, TRUE, FALSE, No, http://tor.li/, https://tor.li/, , , http://tor.li/dist/, https://tor.li/dist/, , , -Tor Fan, Tor Supporter, DE, Germany, DE, TRUE, FALSE, NO, http://tor.externenprüfung-nichtschüler.de/, , , , http://tor.externenprüfung-nichtschüler.de/dist/, , , , -mirror-service(a)netcologne.de, NetCologne GmbH, DE, NRW, TRUE, TRUE, No, http://mirror.netcologne.de/torproject.org, , rsync://mirror.netcologne.de/torproject.org, ftp://mirror.netcologne.de/torproject.org/, http://mirror.netcologne.de/torproject.org/dist, , rsync://mirror.netcologne.de/torproject.org/dist, , , -admin AT netgull DOT com, NetGull, US, United States, North America, TRUE, TRUE, No, , , , , http://www.netgull.com/torproject/, , , , -mirrors[at]ip-connect[dot]vn[dot]ua, IP-Connect LLC, UA, VN, TRUE, TRUE, Yes, http://torproject.ip-connect.vn.ua, , rsync://torproject.ip-connect.vn.ua/torproject, ftp://torproject.ip-connect.vn.ua/mirror/torproject/, http://torproject.ip-connect.vn.ua/dist, , rsync://torproject.ip-connect.vn.ua/torproject/dist, , , -torsupport AT tb-itf DOT de, TB-ITF, , DE, Germany, Europe, TRUE, TRUE, No, http://tormirror.tb-itf-tor.de, https://tormirror.tb-itf-tor.de, , , , http://tormirror.tb-itf-tor.de/dist/, https://tormirror.tb-itf-tor.de/dist/, -admin at koreswatanabe dottnet, Tor Supporter, RO, Romania, RO, TRUE, TRUE, No, http://tor-relay.koreswatanabe.net, , , , http://tor-relay.koreswatanabe.net/dist/, , , , -calebcenter(a)live.com, calebxu.tk, US, United States, US, TRUE, FALSE, NO, http://tor.calebxu.tk, , rsync://calebxu.tk/tor, ftp://ftp.calebxu.tk, http://tor.calebxu.tk/dist, , , , +Tor Fan, Tor Supporter, US, United States, US, TRUE, TRUE, No, http://tor.loritsu.com/, , , , http://tor.loritsu.com/dist/, , , , +Tor Fan, Tor Supporter, LU, Luxemborg, LU, TRUE, FALSE, No, http://torproject.adamas.ai/, , , , http://torproject.adamas.ai/dist/, , , , +Tor Fan, Tor Supporter, UA, Ukraine, UA, TRUE, FALSE, No, http://torua.reactor-xg.kiev.ua/, , , , http://torua.reactor-xg.kiev.ua/dist/, , , , +Tor Fan, Tor Supporter, FR, France, FR, TRUE, FALSE, No, http://37.187.0.127/tormirror/, , , , http://37.187.0.127/tormirror/dist/, , , , +Tor Fan, Tor Supporter, US, United States, US, TRUE, FALSE, No, http://tor.minibofh.org/, , , , http://tor.minibofh.org/dist/, , , , +Tor Fan, Tor Supporter, UK, United Kingdom, UK, TRUE, FALSE, No, http://tor.mage.me.uk/, , , , http://tor.mage.me.uk/dist/, , , , +nsane2307 eml cc, tor-mirror.de, DE, Germany, Europe, TRUE, FALSE, No, http://tor-mirror.de/, https://tor-mirror.de/, , , http://tor-mirror.de/dist/, https://tor-mirror.de/dist/, , , +citizen428 AT gmail DOT com, [[:bbs:]], DE, Germany, Europe, TRUE, FALSE, No, http://tor.blingblingsquad.net/, https://tor.blingblingsquad.net/, , , http://tor.blingblingsquad.net/dist/, https://tor.blingblingsquad.net/dist/, , , +Tor Fan, Tor Supporter, US, United States, US, TRUE, FALSE, No, , , , , http://www.netgull.com/torproject/, , , , +Tor Fan, NW Linux, US, WA, US, TRUE, FALSE, No, http://torproject.nwlinux.us/, , rsync://nwlinux.us/tor-web, , http://torproject.nwlinux.us/dist/, , rsync://nwlinux.us/tor-dist, , +Tor Fan, Tor Supporter, NL, The Netherlands, NL, TRUE, FALSE, No, , , , , , https://www.coevoet.nl/tor/dist/, , , +Tor Fan, LazyTiger, FR, France, FR, TRUE, FALSE, No, http://tor.taiga-san.net/, , , , http://tor.taiga-san.net/dist/, , , , +Tor Fan, Tor Supporter, EE, Estonia, EE, TRUE, FALSE, No, http://tor.li/, https://tor.li/, , , http://tor.li/dist/, https://tor.li/dist/, , , +Tor Fan, Tor Supporter, DE, Germany, DE, TRUE, FALSE, NO, http://tor.externenprüfung-nichtschüler.de/, , , , http://tor.externenprüfung-nichtschüler.de/dist/, , , , +mirror-service(a)netcologne.de, NetCologne GmbH, DE, NRW, TRUE, TRUE, No, http://mirror.netcologne.de/torproject.org, , rsync://mirror.netcologne.de/torproject.org, ftp://mirror.netcologne.de/torproject.org/, http://mirror.netcologne.de/torproject.org/dist, , rsync://mirror.netcologne.de/torproject.org/dist, , , +admin AT netgull DOT com, NetGull, US, United States, North America, TRUE, TRUE, No, , , , , http://www.netgull.com/torproject/, , , , +mirrors[at]ip-connect[dot]vn[dot]ua, IP-Connect LLC, UA, VN, TRUE, TRUE, Yes, http://torproject.ip-connect.vn.ua, , rsync://torproject.ip-connect.vn.ua/torproject, ftp://torproject.ip-connect.vn.ua/mirror/torproject/, http://torproject.ip-connect.vn.ua/dist, , rsync://torproject.ip-connect.vn.ua/torproject/dist, , , +torsupport AT tb-itf DOT de, TB-ITF, , DE, Germany, Europe, TRUE, TRUE, No, http://tormirror.tb-itf-tor.de, https://tormirror.tb-itf-tor.de, , , , http://tormirror.tb-itf-tor.de/dist/, https://tormirror.tb-itf-tor.de/dist/, +admin at koreswatanabe dottnet, Tor Supporter, RO, Romania, RO, TRUE, TRUE, No, http://tor-relay.koreswatanabe.net, , , , http://tor-relay.koreswatanabe.net/dist/, , , , +calebcenter(a)live.com, calebxu.tk, US, United States, US, TRUE, FALSE, NO, http://tor.calebxu.tk, , rsync://calebxu.tk/tor, ftp://ftp.calebxu.tk, http://tor.calebxu.tk/dist, , , , maki(a)maki-chan.de, Maki Hoshisawa, DE, Germany, DE, TRUE, FALSE, NO, http://tor.mirrors.maki-chan.de/, , , , http://tor.mirrors.maki-chan.de/dist/, , , , Fri Aug 22 14:09:07 2014 info AT zentrum-der-gesundheit DOT de, Zentrum der Gesundheit, DK, Denmark, Europe, TRUE, FALSE, No, http://tor.idnr.ws/, , , , http://tor.idnr.ws/dist/, , , , Mon Sep 1 17:16:00 2014 mirror ntzk de, Netzkonstrukt Berlin, DE, Germany, Europe, TRUE, FALSE, No, http://mirror.ntzk.de/torproject.org/, , , , http://mirror.ntzk.de/torproject.org/dist/, , , , Mon Sep 29 23:44:59 2014 @@ -86,8 +86,8 @@ Tor Fan, Ramos Research, US, United States, US, TRUE, TRUE, No, http://tor.ramosresearch.com/, , , , http://tor.ramosresearch.com/dist/, , , , Mon Sep 29 23:44:59 2014 Tor Fan, Tor Supporter, DE, Germany, Europe, TRUE, FALSE, No, http://tor.euve33747.vserver.de/, , , , http://tor.euve33747.vserver.de/dist, , , , Mon Sep 29 23:44:59 2014 s7r[at]sky-ip[d0t]org, sky-ip.org, NL, Netherlands, NL, TRUE, FALSE, No, http://beautiful-mind.sky-ip.org/, , , , http://beautiful-mind.sky-ip.org/dist/, , , , Mon Sep 29 23:44:59 2014 -tor#pajonzeck#de, ITsn, DE, Germany, Europe, TRUE, FALSE, No, http://tor.pajonzeck.de/, https://tor.pajonzeck.de/, rsync://tor.pajonzeck.de/tor, http://tor.pajonzeck.de/dist/, https://tor.pajonzeck.de/dist/, rsync://tor.pajonzeck.de/tor/dist, , http://zgfgvob256pffy62.onion, Mon Sep 29 23:44:59 2014 +tor#pajonzeck#de, ITsn, DE, Germany, Europe, TRUE, FALSE, No, http://tor.pajonzeck.de/, https://tor.pajonzeck.de/, rsync://tor.pajonzeck.de/tor, http://tor.pajonzeck.de/dist/, https://tor.pajonzeck.de/dist/,, rsync://tor.pajonzeck.de/tor/dist, http://zgfgvob256pffy62.onion, Mon Sep 29 23:44:59 2014 peter AT ludikovsky DOT name, Tor Supporter, AT, Austria, Europe, TRUE, TRUE, No, http://tor.ludikovsky.name/, , , , http://tor.ludikovsky.name/dist, , , http://54lnbzjo6xlr4f4j.onion/, Mon Sep 29 23:44:59 2014 -admin AT nuclear DASH weapons DOT net, Setec Administrator, US, Texas, Austin, TRUE, FALSE, No, http://tor.nuclear-weapons.net, https://tor.nuclear-weapons.net, , , , http://tor.nuclear-weapons.net/dist, https://tor.nuclear-weapons.net/dist, , Mon Sep 29 23:44:59 2014 +admin AT nuclear DASH weapons DOT net, Setec Administrator, US, Texas, Austin, TRUE, FALSE, No, http://tor.nuclear-weapons.net, https://tor.nuclear-weapons.net, , , http://tor.nuclear-weapons.net/dist,, https://tor.nuclear-weapons.net/dist, , Mon Sep 29 23:44:59 2014 0x43DE8191, Tor Supporter, DE, Germany, Europe, TRUE, TRUE, No, http://torproject.hactar.bz, , , , http://torproject.hactar.bz/dist/, , , , Mon Sep 29 23:44:59 2014 --nick at calyx dot com, The Calyx Institute, US, United States, North America, TRUE, FALSE, No, http://tor.calyxinstitute.org, https://tor.calyxinstitute.org, , , http://tor.calyxinstitute.org/dist/, https://tor.calyxinstitute.org/dist/, , http://tmdrhl4e4anhsjc5.onion, +-nick at calyx dot com, The Calyx Institute, US, United States, North America, TRUE, FALSE, No, http://tor.calyxinstitute.org, https://tor.calyxinstitute.org, , , http://tor.calyxinstitute.org/dist/, https://tor.calyxinstitute.org/dist/, , http://tmdrhl4e4anhsjc5.onion,

1 0

[tor/master] Run correctly on OpenBSD systems without SSL_METHOD.get_cipher_by_char
by nickm＠torproject.org 03 Oct '14

03 Oct '14

commit d1fa0163e571913b8e4972c5c8a2d46798f46156 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Oct 3 12:15:09 2014 -0400 Run correctly on OpenBSD systems without SSL_METHOD.get_cipher_by_char Also, make sure we will compile correctly on systems where they finally rip it out. Fixes issue #13325. Caused by this openbsd commit: http://marc.info/?l=openbsd-cvs&m=140768179627976&w=2 Reported by Fredzupy. --- changes/bug13325 | 4 ++++ configure.ac | 4 ++++ src/common/tortls.c | 48 ++++++++++++++++++++++++++++++++++++++---------- 3 files changed, 46 insertions(+), 10 deletions(-) diff --git a/changes/bug13325 b/changes/bug13325 new file mode 100644 index 0000000..b1da4d0 --- /dev/null +++ b/changes/bug13325 @@ -0,0 +1,4 @@ + o Compilation fixes: + - Build and run correctly on systems like OpenBSD-current that + have patched OpenSSL to remove get_cipher_by_char and/or its + implementations. Fixes issue 13325. diff --git a/configure.ac b/configure.ac index 3456013..3548474 100644 --- a/configure.ac +++ b/configure.ac @@ -524,6 +524,10 @@ else fi AC_SUBST(TOR_OPENSSL_LIBS) +AC_CHECK_MEMBERS([struct ssl_method_st.get_cipher_by_char], , , +[#include <openssl/ssl.h> +]) + dnl ------------------------------------------------------ dnl Where do you live, zlib? And how do we call you? diff --git a/src/common/tortls.c b/src/common/tortls.c index c13b12f..9d45eb0 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -1478,6 +1478,43 @@ static uint16_t v2_cipher_list[] = { /** Have we removed the unrecognized ciphers from v2_cipher_list yet? */ static int v2_cipher_list_pruned = 0; +/** Return 0 if m does not support the cipher with ID cipher; + * return 1 if it does support it, or if we have no way to tell. */ +static int +find_cipher_by_id(const SSL_METHOD *m, uint16_t cipher) +{ + const SSL_CIPHER *c; +#ifdef HAVE_STRUCT_SSL_METHOD_ST_GET_CIPHER_BY_CHAR + if (m && m->get_cipher_by_char) { + unsigned char cipherid[3]; + set_uint16(cipherid, htons(cipher)); + cipherid[2] = 0; /* If ssl23_get_cipher_by_char finds no cipher starting + * with a two-byte 'cipherid', it may look for a v2 + * cipher with the appropriate 3 bytes. */ + c = m->get_cipher_by_char(cipherid); + if (c) + tor_assert((c->id & 0xffff) == cipher); + return c != NULL; + } else +#endif + if (m && m->get_cipher && m->num_ciphers) { + /* It would seem that some of the "let's-clean-up-openssl" forks have + * removed the get_cipher_by_char function. Okay, so now you get a + * quadratic search. + */ + int i; + for (i = 0; i < m->num_ciphers(); ++i) { + c = m->get_cipher(i); + if (c && (c->id & 0xffff) == cipher) { + return 1; + } + } + return 0; + } else { + return 1; /* No way to search */ + } +} + /** Remove from v2_cipher_list every cipher that we don't support, so that * comparing v2_cipher_list to a client's cipher list will give a sensible * result. */ @@ -1489,16 +1526,7 @@ prune_v2_cipher_list(void) inp = outp = v2_cipher_list; while (*inp) { - unsigned char cipherid[3]; - const SSL_CIPHER *cipher; - /* Is there no better way to do this? */ - set_uint16(cipherid, htons(*inp)); - cipherid[2] = 0; /* If ssl23_get_cipher_by_char finds no cipher starting - * with a two-byte 'cipherid', it may look for a v2 - * cipher with the appropriate 3 bytes. */ - cipher = m->get_cipher_by_char(cipherid); - if (cipher) { - tor_assert((cipher->id & 0xffff) == *inp); + if (find_cipher_by_id(m, *inp)) { *outp++ = *inp++; } else { inp++;

1 0

[tor/master] Merge remote-tracking branch 'public/bug13325_024' into maint-0.2.5
by nickm＠torproject.org 03 Oct '14

03 Oct '14

commit d315b8e8bc712f881fcc70624cb135a8e3855f63 Merge: e1a25f0 d1fa016 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Oct 3 19:57:41 2014 -0400 Merge remote-tracking branch 'public/bug13325_024' into maint-0.2.5 changes/bug13325 | 4 ++++ configure.ac | 4 ++++ src/common/tortls.c | 48 ++++++++++++++++++++++++++++++++++++++---------- 3 files changed, 46 insertions(+), 10 deletions(-)

1 0

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.5'
by nickm＠torproject.org 03 Oct '14

03 Oct '14

commit bbffd0a0187334c3ce80b446b08b6ea195da5063 Merge: b448ec1 d315b8e Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Oct 3 19:58:25 2014 -0400 Merge remote-tracking branch 'origin/maint-0.2.5' changes/bug13325 | 4 ++++ configure.ac | 4 ++++ src/common/tortls.c | 48 ++++++++++++++++++++++++++++++++++++++---------- 3 files changed, 46 insertions(+), 10 deletions(-)

1 0

[tor/maint-0.2.5] Run correctly on OpenBSD systems without SSL_METHOD.get_cipher_by_char
by nickm＠torproject.org 03 Oct '14

03 Oct '14

commit d1fa0163e571913b8e4972c5c8a2d46798f46156 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Oct 3 12:15:09 2014 -0400 Run correctly on OpenBSD systems without SSL_METHOD.get_cipher_by_char Also, make sure we will compile correctly on systems where they finally rip it out. Fixes issue #13325. Caused by this openbsd commit: http://marc.info/?l=openbsd-cvs&m=140768179627976&w=2 Reported by Fredzupy. --- changes/bug13325 | 4 ++++ configure.ac | 4 ++++ src/common/tortls.c | 48 ++++++++++++++++++++++++++++++++++++++---------- 3 files changed, 46 insertions(+), 10 deletions(-) diff --git a/changes/bug13325 b/changes/bug13325 new file mode 100644 index 0000000..b1da4d0 --- /dev/null +++ b/changes/bug13325 @@ -0,0 +1,4 @@ + o Compilation fixes: + - Build and run correctly on systems like OpenBSD-current that + have patched OpenSSL to remove get_cipher_by_char and/or its + implementations. Fixes issue 13325. diff --git a/configure.ac b/configure.ac index 3456013..3548474 100644 --- a/configure.ac +++ b/configure.ac @@ -524,6 +524,10 @@ else fi AC_SUBST(TOR_OPENSSL_LIBS) +AC_CHECK_MEMBERS([struct ssl_method_st.get_cipher_by_char], , , +[#include <openssl/ssl.h> +]) + dnl ------------------------------------------------------ dnl Where do you live, zlib? And how do we call you? diff --git a/src/common/tortls.c b/src/common/tortls.c index c13b12f..9d45eb0 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -1478,6 +1478,43 @@ static uint16_t v2_cipher_list[] = { /** Have we removed the unrecognized ciphers from v2_cipher_list yet? */ static int v2_cipher_list_pruned = 0; +/** Return 0 if m does not support the cipher with ID cipher; + * return 1 if it does support it, or if we have no way to tell. */ +static int +find_cipher_by_id(const SSL_METHOD *m, uint16_t cipher) +{ + const SSL_CIPHER *c; +#ifdef HAVE_STRUCT_SSL_METHOD_ST_GET_CIPHER_BY_CHAR + if (m && m->get_cipher_by_char) { + unsigned char cipherid[3]; + set_uint16(cipherid, htons(cipher)); + cipherid[2] = 0; /* If ssl23_get_cipher_by_char finds no cipher starting + * with a two-byte 'cipherid', it may look for a v2 + * cipher with the appropriate 3 bytes. */ + c = m->get_cipher_by_char(cipherid); + if (c) + tor_assert((c->id & 0xffff) == cipher); + return c != NULL; + } else +#endif + if (m && m->get_cipher && m->num_ciphers) { + /* It would seem that some of the "let's-clean-up-openssl" forks have + * removed the get_cipher_by_char function. Okay, so now you get a + * quadratic search. + */ + int i; + for (i = 0; i < m->num_ciphers(); ++i) { + c = m->get_cipher(i); + if (c && (c->id & 0xffff) == cipher) { + return 1; + } + } + return 0; + } else { + return 1; /* No way to search */ + } +} + /** Remove from v2_cipher_list every cipher that we don't support, so that * comparing v2_cipher_list to a client's cipher list will give a sensible * result. */ @@ -1489,16 +1526,7 @@ prune_v2_cipher_list(void) inp = outp = v2_cipher_list; while (*inp) { - unsigned char cipherid[3]; - const SSL_CIPHER *cipher; - /* Is there no better way to do this? */ - set_uint16(cipherid, htons(*inp)); - cipherid[2] = 0; /* If ssl23_get_cipher_by_char finds no cipher starting - * with a two-byte 'cipherid', it may look for a v2 - * cipher with the appropriate 3 bytes. */ - cipher = m->get_cipher_by_char(cipherid); - if (cipher) { - tor_assert((cipher->id & 0xffff) == *inp); + if (find_cipher_by_id(m, *inp)) { *outp++ = *inp++; } else { inp++;

1 0

[tor/maint-0.2.5] Merge remote-tracking branch 'public/bug13325_024' into maint-0.2.5
by nickm＠torproject.org 03 Oct '14

03 Oct '14

commit d315b8e8bc712f881fcc70624cb135a8e3855f63 Merge: e1a25f0 d1fa016 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Oct 3 19:57:41 2014 -0400 Merge remote-tracking branch 'public/bug13325_024' into maint-0.2.5 changes/bug13325 | 4 ++++ configure.ac | 4 ++++ src/common/tortls.c | 48 ++++++++++++++++++++++++++++++++++++++---------- 3 files changed, 46 insertions(+), 10 deletions(-)

1 0

[translation/tails-perl5lib_completed] Update translations for tails-perl5lib_completed
by translation＠torproject.org 03 Oct '14

03 Oct '14

commit 83b27100019fcec113f84e7a7e47f7117b4fd0b4 Author: Translation commit bot <translation(a)torproject.org> Date: Fri Oct 3 23:16:22 2014 +0000 Update translations for tails-perl5lib_completed --- de.po | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/de.po b/de.po index 6bdab07..420b76d 100644 --- a/de.po +++ b/de.po @@ -10,7 +10,7 @@ msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: Tails developers <tails(a)boum.org>\n" "POT-Creation-Date: 2014-06-24 11:37+0200\n" -"PO-Revision-Date: 2014-10-03 22:42+0000\n" +"PO-Revision-Date: 2014-10-03 22:50+0000\n" "Last-Translator: rike\n" "Language-Team: German (http://www.transifex.com/projects/p/torproject/language/de/)\n" "MIME-Version: 1.0\n"

1 0

[translation/tails-perl5lib] Update translations for tails-perl5lib
by translation＠torproject.org 03 Oct '14

03 Oct '14

commit df0c8557818d73ce2635920a6c3fff64ec5738d3 Author: Translation commit bot <translation(a)torproject.org> Date: Fri Oct 3 23:16:18 2014 +0000 Update translations for tails-perl5lib --- de.po | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/de.po b/de.po index 6bdab07..420b76d 100644 --- a/de.po +++ b/de.po @@ -10,7 +10,7 @@ msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: Tails developers <tails(a)boum.org>\n" "POT-Creation-Date: 2014-06-24 11:37+0200\n" -"PO-Revision-Date: 2014-10-03 22:42+0000\n" +"PO-Revision-Date: 2014-10-03 22:50+0000\n" "Last-Translator: rike\n" "Language-Team: German (http://www.transifex.com/projects/p/torproject/language/de/)\n" "MIME-Version: 1.0\n"

1 0