October 2014 - tor-commits - lists.torproject.org

[tor/release-0.2.5] Merge branch 'bug13295_v2_025' into maint-0.2.5
by nickm＠torproject.org 19 Oct '14

19 Oct '14

commit e1a25f0c3602e007872277ef9ab437cc97cfd47b Merge: 87576e8 09951be Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Sep 29 13:02:35 2014 -0400 Merge branch 'bug13295_v2_025' into maint-0.2.5 changes/13295 | 5 +++++ src/common/sandbox.c | 21 +++++++++++++++++++++ src/common/sandbox.h | 2 ++ src/tools/tor-resolve.c | 2 ++ 4 files changed, 30 insertions(+)

1 0

[tor/release-0.2.5] Run correctly on OpenBSD systems without SSL_METHOD.get_cipher_by_char
by nickm＠torproject.org 19 Oct '14

19 Oct '14

commit d1fa0163e571913b8e4972c5c8a2d46798f46156 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Oct 3 12:15:09 2014 -0400 Run correctly on OpenBSD systems without SSL_METHOD.get_cipher_by_char Also, make sure we will compile correctly on systems where they finally rip it out. Fixes issue #13325. Caused by this openbsd commit: http://marc.info/?l=openbsd-cvs&m=140768179627976&w=2 Reported by Fredzupy. --- changes/bug13325 | 4 ++++ configure.ac | 4 ++++ src/common/tortls.c | 48 ++++++++++++++++++++++++++++++++++++++---------- 3 files changed, 46 insertions(+), 10 deletions(-) diff --git a/changes/bug13325 b/changes/bug13325 new file mode 100644 index 0000000..b1da4d0 --- /dev/null +++ b/changes/bug13325 @@ -0,0 +1,4 @@ + o Compilation fixes: + - Build and run correctly on systems like OpenBSD-current that + have patched OpenSSL to remove get_cipher_by_char and/or its + implementations. Fixes issue 13325. diff --git a/configure.ac b/configure.ac index 3456013..3548474 100644 --- a/configure.ac +++ b/configure.ac @@ -524,6 +524,10 @@ else fi AC_SUBST(TOR_OPENSSL_LIBS) +AC_CHECK_MEMBERS([struct ssl_method_st.get_cipher_by_char], , , +[#include <openssl/ssl.h> +]) + dnl ------------------------------------------------------ dnl Where do you live, zlib? And how do we call you? diff --git a/src/common/tortls.c b/src/common/tortls.c index c13b12f..9d45eb0 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -1478,6 +1478,43 @@ static uint16_t v2_cipher_list[] = { /** Have we removed the unrecognized ciphers from v2_cipher_list yet? */ static int v2_cipher_list_pruned = 0; +/** Return 0 if m does not support the cipher with ID cipher; + * return 1 if it does support it, or if we have no way to tell. */ +static int +find_cipher_by_id(const SSL_METHOD *m, uint16_t cipher) +{ + const SSL_CIPHER *c; +#ifdef HAVE_STRUCT_SSL_METHOD_ST_GET_CIPHER_BY_CHAR + if (m && m->get_cipher_by_char) { + unsigned char cipherid[3]; + set_uint16(cipherid, htons(cipher)); + cipherid[2] = 0; /* If ssl23_get_cipher_by_char finds no cipher starting + * with a two-byte 'cipherid', it may look for a v2 + * cipher with the appropriate 3 bytes. */ + c = m->get_cipher_by_char(cipherid); + if (c) + tor_assert((c->id & 0xffff) == cipher); + return c != NULL; + } else +#endif + if (m && m->get_cipher && m->num_ciphers) { + /* It would seem that some of the "let's-clean-up-openssl" forks have + * removed the get_cipher_by_char function. Okay, so now you get a + * quadratic search. + */ + int i; + for (i = 0; i < m->num_ciphers(); ++i) { + c = m->get_cipher(i); + if (c && (c->id & 0xffff) == cipher) { + return 1; + } + } + return 0; + } else { + return 1; /* No way to search */ + } +} + /** Remove from v2_cipher_list every cipher that we don't support, so that * comparing v2_cipher_list to a client's cipher list will give a sensible * result. */ @@ -1489,16 +1526,7 @@ prune_v2_cipher_list(void) inp = outp = v2_cipher_list; while (*inp) { - unsigned char cipherid[3]; - const SSL_CIPHER *cipher; - /* Is there no better way to do this? */ - set_uint16(cipherid, htons(*inp)); - cipherid[2] = 0; /* If ssl23_get_cipher_by_char finds no cipher starting - * with a two-byte 'cipherid', it may look for a v2 - * cipher with the appropriate 3 bytes. */ - cipher = m->get_cipher_by_char(cipherid); - if (cipher) { - tor_assert((cipher->id & 0xffff) == *inp); + if (find_cipher_by_id(m, *inp)) { *outp++ = *inp++; } else { inp++;

1 0

[webwml/staging] Fix #9736
by sebastian＠torproject.org 19 Oct '14

19 Oct '14

commit 281b047fd19a8ee45b3de3986f94c9497e232f3a Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Sun Oct 19 15:09:26 2014 +0200 Fix #9736 --- tordnsel/exitlist-spec.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tordnsel/exitlist-spec.txt b/tordnsel/exitlist-spec.txt index 216c43f..b2b11b4 100644 --- a/tordnsel/exitlist-spec.txt +++ b/tordnsel/exitlist-spec.txt @@ -6,9 +6,9 @@ for Tor exit nodes. The implementation is available at https://www.torproject.org/tordnsel/dist/ -The design and its rationale are described in the Tor sources at +The design and its rationale were described in the Tor sources, see - /doc/contrib/torel-design.txt + https://gitweb.torproject.org/tordnsel.git/blob/HEAD:/doc/torel-design.txt This document is an attempt to make sense of the exit list format that TorDNSEL publishes without the original TorDNSEL author being around.

1 0

[webwml/master] Fix #9736
by sebastian＠torproject.org 19 Oct '14

19 Oct '14

commit 281b047fd19a8ee45b3de3986f94c9497e232f3a Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Sun Oct 19 15:09:26 2014 +0200 Fix #9736 --- tordnsel/exitlist-spec.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tordnsel/exitlist-spec.txt b/tordnsel/exitlist-spec.txt index 216c43f..b2b11b4 100644 --- a/tordnsel/exitlist-spec.txt +++ b/tordnsel/exitlist-spec.txt @@ -6,9 +6,9 @@ for Tor exit nodes. The implementation is available at https://www.torproject.org/tordnsel/dist/ -The design and its rationale are described in the Tor sources at +The design and its rationale were described in the Tor sources, see - /doc/contrib/torel-design.txt + https://gitweb.torproject.org/tordnsel.git/blob/HEAD:/doc/torel-design.txt This document is an attempt to make sense of the exit list format that TorDNSEL publishes without the original TorDNSEL author being around.

1 0

[translation/tails-misc] Update translations for tails-misc
by translation＠torproject.org 19 Oct '14

19 Oct '14

commit c13fd30f096e4b34bb4e3f73564bb8e7fbef472c Author: Translation commit bot <translation(a)torproject.org> Date: Sun Oct 19 12:45:41 2014 +0000 Update translations for tails-misc --- ja.po | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ja.po b/ja.po index 981ed3c..d08a0c9 100644 --- a/ja.po +++ b/ja.po @@ -11,7 +11,7 @@ msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: \n" "POT-Creation-Date: 2014-10-15 17:57+0200\n" -"PO-Revision-Date: 2014-10-19 12:15+0000\n" +"PO-Revision-Date: 2014-10-19 12:21+0000\n" "Last-Translator: sunpower92 <fumihito92(a)gmail.com>\n" "Language-Team: Japanese (http://www.transifex.com/projects/p/torproject/language/ja/)\n" "MIME-Version: 1.0\n" @@ -439,7 +439,7 @@ msgstr "I2Pは起動できませんでした" msgid "" "Something went wrong when I2P was starting. Check the logs in /var/log/i2p " "for more information." -msgstr "" +msgstr "I2Pの開始時になにかエラーが起きたようです。/var/log/i2p にあるログファイルを覗いてみてください。何か手がかりがあるかもしれません。" #: config/chroot_local-includes/usr/local/sbin/tails-i2p:42 msgid "I2P's router console is ready"

1 0

[webwml/staging] Tweak running-mirrors layout some more
by sebastian＠torproject.org 19 Oct '14

19 Oct '14

commit 2038af2c2083b2ff9cea5cf6e775d4f70929a78c Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Sun Oct 19 14:44:45 2014 +0200 Tweak running-mirrors layout some more --- docs/en/running-a-mirror.wml | 29 ++++++++++++++++------------- 1 file changed, 16 insertions(+), 13 deletions(-) diff --git a/docs/en/running-a-mirror.wml b/docs/en/running-a-mirror.wml index ae2afb5..cf3bbc9 100644 --- a/docs/en/running-a-mirror.wml +++ b/docs/en/running-a-mirror.wml @@ -23,7 +23,7 @@ If you would like to run a mirror, it's as easy as these commands to download everything a mirror should share with the world: - + <tt> <pre> rsync -av --exclude 'dist' --delete rsync://rsync.torproject.org/website-mirror tor-mirror/ @@ -54,6 +54,7 @@ rsync -av --delete rsync://rsync.torproject.org/dist-mirror tor-mirror/dist/ An example cronjob to update a full mirror once every 6 hours may look like so: + <tt> <pre> # m h dom mon dow command @@ -61,30 +62,31 @@ rsync -av --delete rsync://rsync.torproject.org/dist-mirror tor-mirror/dist/ 5 */6 * * * rsync -aq --delete rsync://rsync.torproject.org/dist-mirror/ /var/www/mirrors/torproject.org/dist </pre> </tt> - - + For mirror operators that use Apache, we have created a sample virtual host configuration file to use: + <tt> <pre> <VirtualHost 10.10.10.10:80> - ServerAdmin youremail(a)example.com - ServerName ServerNameHere + ServerAdmin youremail(a)example.com + ServerName ServerNameHere - DocumentRoot /var/www/mirrors/torproject.org + DocumentRoot /var/www/mirrors/torproject.org - <Directory /var/www/mirrors/torproject.org/> - Options MultiViews Indexes - DirectoryIndex index - AllowOverride None - </Directory> + <Directory /var/www/mirrors/torproject.org/> + Options MultiViews Indexes + DirectoryIndex index + AllowOverride None + </Directory> </VirtualHost> </pre> </tt> - + For mirror operators that use nginx, we created a sample virtual host configuration file to use: + <tt> <pre> server { @@ -100,9 +102,10 @@ server { } </pre> </tt> - + If you use nginx, please ensure the text/html line in <tt>/etc/nginx/mime.types</tt> matches: + <tt> <pre> text/html en html htm shtml;

1 0

[webwml/master] Update mirroring instructions based on feedback by weasel
by sebastian＠torproject.org 19 Oct '14

19 Oct '14

commit 859376f8c12721d11317f91d8b3cc94fe838fc22 Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Sun Oct 19 13:35:37 2014 +0200 Update mirroring instructions based on feedback by weasel --- docs/en/running-a-mirror.wml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/docs/en/running-a-mirror.wml b/docs/en/running-a-mirror.wml index 056fad1..371566b 100644 --- a/docs/en/running-a-mirror.wml +++ b/docs/en/running-a-mirror.wml @@ -25,8 +25,10 @@ everything a mirror should share with the world: <tt> - rsync -av --exclude 'dist'--delete rsync://rsync.torproject.org/website-mirror tor-mirror/ + <pre> + rsync -av --exclude 'dist' --delete rsync://rsync.torproject.org/website-mirror tor-mirror/ rsync -av --delete rsync://rsync.torproject.org/dist-mirror tor-mirror/dist/ + </pre> </tt> @@ -92,7 +94,7 @@ root /var/www/mirrors/torproject.org; index index.html.en; - location ^~ /dist/ { + location / { autoindex on; } }

1 0

[webwml/master] Update mirror instructions
by sebastian＠torproject.org 19 Oct '14

19 Oct '14

commit bccb6f1c2e94953ded23563b9a2b329154590c9f Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Sun Oct 19 12:42:04 2014 +0200 Update mirror instructions --- docs/en/running-a-mirror.wml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/docs/en/running-a-mirror.wml b/docs/en/running-a-mirror.wml index c940fd7..056fad1 100644 --- a/docs/en/running-a-mirror.wml +++ b/docs/en/running-a-mirror.wml @@ -17,15 +17,16 @@ our mirrors are publicly listed on <a href="<page getinvolved/mirrors>">our mirrors page</a>. We've included some sample commands and configuration below to make the initial setup and ongoing maintenance a minimal effort. - The Tor website and distribution directory currently require 8.0 GB of + The Tor website and distribution directory currently require roughly 6 GB of disk space. <h2><a class="anchor" href="#sysconfig">Configuring your System</a></h2> - If you would like to run a mirror, it's as easy as this command to download + If you would like to run a mirror, it's as easy as these commands to download everything a mirror should share with the world: <tt> - rsync -av --delete rsync://rsync.torproject.org/website-mirror tor-mirror/ + rsync -av --exclude 'dist'--delete rsync://rsync.torproject.org/website-mirror tor-mirror/ + rsync -av --delete rsync://rsync.torproject.org/dist-mirror tor-mirror/dist/ </tt> @@ -55,6 +56,7 @@ <pre> # m h dom mon dow command 0 */6 * * * rsync -aq --delete rsync://rsync.torproject.org/website-mirror/ /var/www/mirrors/torproject.org + 5 */6 * * * rsync -aq --delete rsync://rsync.torproject.org/dist-mirror/ /var/www/mirrors/torproject.org/dist </pre> </tt>

1 0

[webwml/master] Fix some <pre> on running-a-mirror
by sebastian＠torproject.org 19 Oct '14

19 Oct '14

commit fddc41c52bdc658fee75ad3f6351e2ae14b6f6f9 Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Sun Oct 19 13:44:07 2014 +0200 Fix some <pre> on running-a-mirror --- docs/en/running-a-mirror.wml | 68 +++++++++++++++++++++--------------------- 1 file changed, 34 insertions(+), 34 deletions(-) diff --git a/docs/en/running-a-mirror.wml b/docs/en/running-a-mirror.wml index 371566b..ae2afb5 100644 --- a/docs/en/running-a-mirror.wml +++ b/docs/en/running-a-mirror.wml @@ -25,10 +25,10 @@ everything a mirror should share with the world: <tt> - <pre> - rsync -av --exclude 'dist' --delete rsync://rsync.torproject.org/website-mirror tor-mirror/ - rsync -av --delete rsync://rsync.torproject.org/dist-mirror tor-mirror/dist/ - </pre> +<pre> +rsync -av --exclude 'dist' --delete rsync://rsync.torproject.org/website-mirror tor-mirror/ +rsync -av --delete rsync://rsync.torproject.org/dist-mirror tor-mirror/dist/ +</pre> </tt> @@ -55,58 +55,58 @@ An example cronjob to update a full mirror once every 6 hours may look like so: <tt> - <pre> - # m h dom mon dow command - 0 */6 * * * rsync -aq --delete rsync://rsync.torproject.org/website-mirror/ /var/www/mirrors/torproject.org - 5 */6 * * * rsync -aq --delete rsync://rsync.torproject.org/dist-mirror/ /var/www/mirrors/torproject.org/dist - </pre> +<pre> +# m h dom mon dow command +0 */6 * * * rsync -aq --delete rsync://rsync.torproject.org/website-mirror/ /var/www/mirrors/torproject.org +5 */6 * * * rsync -aq --delete rsync://rsync.torproject.org/dist-mirror/ /var/www/mirrors/torproject.org/dist +</pre> </tt> For mirror operators that use Apache, we have created a sample virtual host configuration file to use: <tt> - <pre> - <VirtualHost 10.10.10.10:80> - ServerAdmin youremail(a)example.com - ServerName ServerNameHere +<pre> +<VirtualHost 10.10.10.10:80> + ServerAdmin youremail(a)example.com + ServerName ServerNameHere - DocumentRoot /var/www/mirrors/torproject.org + DocumentRoot /var/www/mirrors/torproject.org - <Directory /var/www/mirrors/torproject.org/> - Options MultiViews Indexes - DirectoryIndex index - AllowOverride None - </Directory> + <Directory /var/www/mirrors/torproject.org/> + Options MultiViews Indexes + DirectoryIndex index + AllowOverride None + </Directory> - </VirtualHost> - </pre> +</VirtualHost> +</pre> </tt> For mirror operators that use nginx, we created a sample virtual host configuration file to use: <tt> - <pre> - server { - listen 10.10.10.10:80; - server_name your.example.com; +<pre> +server { + listen 10.10.10.10:80; + server_name your.example.com; - root /var/www/mirrors/torproject.org; - index index.html.en; + root /var/www/mirrors/torproject.org; + index index.html.en; - location / { - autoindex on; - } + location / { + autoindex on; } - </pre> +} +</pre> </tt> If you use nginx, please ensure the text/html line in <tt>/etc/nginx/mime.types</tt> matches: <tt> - <pre> - text/html en html htm shtml; - </pre> +<pre> +text/html en html htm shtml; +</pre> </tt> Please ensure that you keep your mirror updated (we suggest automating this

1 0

[webwml/master] Tweak running-mirrors layout some more
by sebastian＠torproject.org 19 Oct '14

19 Oct '14

commit 2038af2c2083b2ff9cea5cf6e775d4f70929a78c Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Sun Oct 19 14:44:45 2014 +0200 Tweak running-mirrors layout some more --- docs/en/running-a-mirror.wml | 29 ++++++++++++++++------------- 1 file changed, 16 insertions(+), 13 deletions(-) diff --git a/docs/en/running-a-mirror.wml b/docs/en/running-a-mirror.wml index ae2afb5..cf3bbc9 100644 --- a/docs/en/running-a-mirror.wml +++ b/docs/en/running-a-mirror.wml @@ -23,7 +23,7 @@ If you would like to run a mirror, it's as easy as these commands to download everything a mirror should share with the world: - + <tt> <pre> rsync -av --exclude 'dist' --delete rsync://rsync.torproject.org/website-mirror tor-mirror/ @@ -54,6 +54,7 @@ rsync -av --delete rsync://rsync.torproject.org/dist-mirror tor-mirror/dist/ An example cronjob to update a full mirror once every 6 hours may look like so: + <tt> <pre> # m h dom mon dow command @@ -61,30 +62,31 @@ rsync -av --delete rsync://rsync.torproject.org/dist-mirror tor-mirror/dist/ 5 */6 * * * rsync -aq --delete rsync://rsync.torproject.org/dist-mirror/ /var/www/mirrors/torproject.org/dist </pre> </tt> - - + For mirror operators that use Apache, we have created a sample virtual host configuration file to use: + <tt> <pre> <VirtualHost 10.10.10.10:80> - ServerAdmin youremail(a)example.com - ServerName ServerNameHere + ServerAdmin youremail(a)example.com + ServerName ServerNameHere - DocumentRoot /var/www/mirrors/torproject.org + DocumentRoot /var/www/mirrors/torproject.org - <Directory /var/www/mirrors/torproject.org/> - Options MultiViews Indexes - DirectoryIndex index - AllowOverride None - </Directory> + <Directory /var/www/mirrors/torproject.org/> + Options MultiViews Indexes + DirectoryIndex index + AllowOverride None + </Directory> </VirtualHost> </pre> </tt> - + For mirror operators that use nginx, we created a sample virtual host configuration file to use: + <tt> <pre> server { @@ -100,9 +102,10 @@ server { } </pre> </tt> - + If you use nginx, please ensure the text/html line in <tt>/etc/nginx/mime.types</tt> matches: + <tt> <pre> text/html en html htm shtml;

1 0