October 2014 - tor-commits - lists.torproject.org

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.3' into maint-0.2.4
by nickm＠torproject.org 19 Oct '14

19 Oct '14

commit 403c6ae78e2dff753d407273ce78c024a0ffb40d Merge: 943fd4a c1dd598 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Oct 19 15:39:48 2014 -0400 Merge remote-tracking branch 'origin/maint-0.2.3' into maint-0.2.4 changes/bug13471 | 5 +++++ 1 file changed, 5 insertions(+)

1 0

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.5'
by nickm＠torproject.org 19 Oct '14

19 Oct '14

commit 291cd50939fdd53fd2d1ee1db4a4859eb2aadae4 Merge: 6c5db03 fd8f21e Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Oct 19 15:40:25 2014 -0400 Merge remote-tracking branch 'origin/maint-0.2.5' changes/bug13471 | 5 +++++ 1 file changed, 5 insertions(+)

1 0

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.4' into maint-0.2.5
by nickm＠torproject.org 19 Oct '14

19 Oct '14

commit fd8f21e730ff2f9f8ace9951bf17fe357a0f8a27 Merge: ab4b296 403c6ae Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Oct 19 15:40:07 2014 -0400 Merge remote-tracking branch 'origin/maint-0.2.4' into maint-0.2.5 changes/bug13471 | 5 +++++ 1 file changed, 5 insertions(+)

1 0

[tor/maint-0.2.5] Note that our #13426 fix is also a #13471 fix.
by nickm＠torproject.org 19 Oct '14

19 Oct '14

commit c1dd598df8972a6b7b8bdeff6a1549a7c171d7dc Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Oct 19 15:38:44 2014 -0400 Note that our #13426 fix is also a #13471 fix. See also http://marc.info/?l=openssl-dev&m=141357408522028&w=2 --- changes/bug13471 | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/changes/bug13471 b/changes/bug13471 new file mode 100644 index 0000000..c116a4a --- /dev/null +++ b/changes/bug13471 @@ -0,0 +1,5 @@ + o Major bugfixes (openssl bug workaround): + - Avoid crashing when using OpenSSL version 0.9.8zc, 1.0.0o, or + 1.0.1j, built with the 'no-ssl3' configuration option. Fixes + bug 13471. This is a workaround for an OpenSSL bug. +

1 0

[tor/maint-0.2.5] Merge remote-tracking branch 'origin/maint-0.2.3' into maint-0.2.4
by nickm＠torproject.org 19 Oct '14

19 Oct '14

commit 403c6ae78e2dff753d407273ce78c024a0ffb40d Merge: 943fd4a c1dd598 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Oct 19 15:39:48 2014 -0400 Merge remote-tracking branch 'origin/maint-0.2.3' into maint-0.2.4 changes/bug13471 | 5 +++++ 1 file changed, 5 insertions(+)

1 0

[tor/maint-0.2.5] Merge remote-tracking branch 'origin/maint-0.2.4' into maint-0.2.5
by nickm＠torproject.org 19 Oct '14

19 Oct '14

commit fd8f21e730ff2f9f8ace9951bf17fe357a0f8a27 Merge: ab4b296 403c6ae Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Oct 19 15:40:07 2014 -0400 Merge remote-tracking branch 'origin/maint-0.2.4' into maint-0.2.5 changes/bug13471 | 5 +++++ 1 file changed, 5 insertions(+)

1 0

[tor/maint-0.2.4] Note that our #13426 fix is also a #13471 fix.
by nickm＠torproject.org 19 Oct '14

19 Oct '14

commit c1dd598df8972a6b7b8bdeff6a1549a7c171d7dc Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Oct 19 15:38:44 2014 -0400 Note that our #13426 fix is also a #13471 fix. See also http://marc.info/?l=openssl-dev&m=141357408522028&w=2 --- changes/bug13471 | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/changes/bug13471 b/changes/bug13471 new file mode 100644 index 0000000..c116a4a --- /dev/null +++ b/changes/bug13471 @@ -0,0 +1,5 @@ + o Major bugfixes (openssl bug workaround): + - Avoid crashing when using OpenSSL version 0.9.8zc, 1.0.0o, or + 1.0.1j, built with the 'no-ssl3' configuration option. Fixes + bug 13471. This is a workaround for an OpenSSL bug. +

1 0

[tor/maint-0.2.4] Merge remote-tracking branch 'origin/maint-0.2.3' into maint-0.2.4
by nickm＠torproject.org 19 Oct '14

19 Oct '14

commit 403c6ae78e2dff753d407273ce78c024a0ffb40d Merge: 943fd4a c1dd598 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Oct 19 15:39:48 2014 -0400 Merge remote-tracking branch 'origin/maint-0.2.3' into maint-0.2.4 changes/bug13471 | 5 +++++ 1 file changed, 5 insertions(+)

1 0

[tor/maint-0.2.3] Note that our #13426 fix is also a #13471 fix.
by nickm＠torproject.org 19 Oct '14

19 Oct '14

commit c1dd598df8972a6b7b8bdeff6a1549a7c171d7dc Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Oct 19 15:38:44 2014 -0400 Note that our #13426 fix is also a #13471 fix. See also http://marc.info/?l=openssl-dev&m=141357408522028&w=2 --- changes/bug13471 | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/changes/bug13471 b/changes/bug13471 new file mode 100644 index 0000000..c116a4a --- /dev/null +++ b/changes/bug13471 @@ -0,0 +1,5 @@ + o Major bugfixes (openssl bug workaround): + - Avoid crashing when using OpenSSL version 0.9.8zc, 1.0.0o, or + 1.0.1j, built with the 'no-ssl3' configuration option. Fixes + bug 13471. This is a workaround for an OpenSSL bug. +

1 0

[tor/release-0.2.4] Disable SSLv3 unconditionally. Closes ticket 13426.
by nickm＠torproject.org 19 Oct '14

19 Oct '14

commit af73d3e4d83ba7f404068008ad617e02b8a0a77b Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Oct 15 11:50:05 2014 -0400 Disable SSLv3 unconditionally. Closes ticket 13426. The POODLE attack doesn't affect Tor, but there's no reason to tempt fate: SSLv3 isn't going to get any better. --- changes/disable_sslv3 | 4 ++++ src/common/tortls.c | 4 +++- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/changes/disable_sslv3 b/changes/disable_sslv3 new file mode 100644 index 0000000..bb4c2df --- /dev/null +++ b/changes/disable_sslv3 @@ -0,0 +1,4 @@ + o Major security fixes: + - Disable support for SSLv3. All versions of OpenSSL in use with + Tor today support TLS 1.0 or later, so we can safely turn off + support for this old (and insecure) protocol. Fixes bug 13426. diff --git a/src/common/tortls.c b/src/common/tortls.c index 60aac64..11fe220 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -1176,10 +1176,11 @@ tor_tls_context_new(crypto_pk_t *identity, unsigned int key_lifetime, goto error; #endif - /* Tell OpenSSL to use SSL3 or TLS1 but not SSL2. */ + /* Tell OpenSSL to use TLS 1.0 or later but not SSL2 or SSL3. */ if (!(result->ctx = SSL_CTX_new(SSLv23_method()))) goto error; SSL_CTX_set_options(result->ctx, SSL_OP_NO_SSLv2); + SSL_CTX_set_options(result->ctx, SSL_OP_NO_SSLv3); /* Disable TLS1.1 and TLS1.2 if they exist. We need to do this to * workaround a bug present in all OpenSSL 1.0.1 versions (as of 1 @@ -1204,6 +1205,7 @@ tor_tls_context_new(crypto_pk_t *identity, unsigned int key_lifetime, SSL_CTX_set_options(result->ctx, SSL_OP_NO_TICKET); #endif + /* XXX This block is now obsolete. */ if ( #ifdef DISABLE_SSL3_HANDSHAKE 1 ||

1 0