May 2015 - tor-commits - lists.torproject.org

[tor/master] Use SSL_CIPHER accessor functions
by nickm＠torproject.org 20 May '15

20 May '15

commit b7f3d5286578aa883218a26720240f9ee68142ee Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu May 14 10:17:37 2015 -0400 Use SSL_CIPHER accessor functions --- src/common/tortls.c | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-) diff --git a/src/common/tortls.c b/src/common/tortls.c index bbbf6c7..168fd56 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -1634,7 +1634,7 @@ tor_tls_classify_client_ciphers(const SSL *ssl, const uint16_t *v2_cipher = v2_cipher_list; for (i = 0; i < sk_SSL_CIPHER_num(peer_ciphers); ++i) { SSL_CIPHER *cipher = sk_SSL_CIPHER_value(peer_ciphers, i); - uint16_t id = cipher->id & 0xffff; + uint16_t id = SSL_CIPHER_get_id(cipher) & 0xffff; if (id == 0x00ff) /* extended renegotiation indicator. */ continue; if (!id || id != *v2_cipher) { @@ -1699,10 +1699,12 @@ tor_tls_client_is_using_v2_ciphers(const SSL *ssl) for (i = 0; i < sk_SSL_CIPHER_num(c1); ++i) { SSL_CIPHER *a = sk_SSL_CIPHER_value(ciphers, i); SSL_CIPHER *b = sk_SSL_CIPHER_value(c1, i); - if (a->id != b->id) { + unsigned long a_id = SSL_CIPHER_get_id(a); + unsigned long b_id = SSL_CIPHER_get_id(b); + if (a_id != b_id) { log_warn(LD_BUG, "Cipher mismatch between session->ciphers and " - "SSL_get_ciphers() at %d: %u vs %u", i, - (unsigned)a, (unsigned)b); + "SSL_get_ciphers() at %d: %lx vs %lx", i, + a_id, b_id); } } } @@ -1901,7 +1903,8 @@ rectify_client_ciphers(SSL *ssl) log_debug(LD_NET, "List was: %s", CLIENT_CIPHER_LIST); for (j = 0; j < sk_SSL_CIPHER_num(ciphers); ++j) { SSL_CIPHER *cipher = sk_SSL_CIPHER_value(ciphers, j); - log_debug(LD_NET, "Cipher %d: %lx %s", j, cipher->id, cipher->name); + log_debug(LD_NET, "Cipher %d: %lx %s", j, + SSL_CIPHER_get_id(cipher), SSL_CIPHER_get_name(cipher)); } /* Then copy as many ciphers as we can from the good list, inserting @@ -1914,17 +1917,17 @@ rectify_client_ciphers(SSL *ssl) SSL_CIPHER *cipher = NULL; if (j < sk_SSL_CIPHER_num(ciphers)) cipher = sk_SSL_CIPHER_value(ciphers, j); - if (cipher && ((cipher->id >> 24) & 0xff) != 3) { + if (cipher && ((SSL_CIPHER_get_id(cipher) >> 24) & 0xff) != 3) { /* Skip over non-v3 ciphers entirely. (This should no longer be * needed, thanks to saying !SSLv2 above.) */ log_debug(LD_NET, "Skipping v%d cipher %s", - (int)((cipher->id>>24) & 0xff), - cipher->name); + (int)((SSL_CIPHER_get_id(cipher)>>24) & 0xff), + SSL_CIPHER_get_name(cipher)); ++j; } else if (cipher && - (cipher->id & 0xffff) == CLIENT_CIPHER_INFO_LIST[i].id) { + (SSL_CIPHER_get_id(cipher) & 0xffff) == CLIENT_CIPHER_INFO_LIST[i].id) { /* "cipher" is the cipher we expect. Put it on the list. */ - log_debug(LD_NET, "Found cipher %s", cipher->name); + log_debug(LD_NET, "Found cipher %s", SSL_CIPHER_get_name(cipher)); sk_SSL_CIPHER_push(CLIENT_CIPHER_STACK, cipher); ++j; ++i;

1 0

[tor/master] tor_tls_get_buffer_sizes() will not work on openssl 1.1. Patch from yawning
by nickm＠torproject.org 20 May '15

20 May '15

commit d55db221e8ed993fa5cf4dd7bdaca62b1610d982 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed May 13 12:12:53 2015 -0400 tor_tls_get_buffer_sizes() will not work on openssl 1.1. Patch from yawning --- src/common/tortls.c | 17 +++++++++++++++-- src/common/tortls.h | 2 +- src/or/main.c | 13 +++++++------ 3 files changed, 23 insertions(+), 9 deletions(-) diff --git a/src/common/tortls.c b/src/common/tortls.c index edb744f..97352c0 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -2875,12 +2875,23 @@ tor_tls_get_tlssecrets(tor_tls_t *tls, uint8_t *secrets_out) * Set *rbuf_capacity to the amount of storage allocated for the read * buffer and *rbuf_bytes to the amount actually used. * Set *wbuf_capacity to the amount of storage allocated for the write - * buffer and *wbuf_bytes to the amount actually used. */ -void + * buffer and *wbuf_bytes to the amount actually used. + * + * Return 0 on success, -1 on failure.*/ +int tor_tls_get_buffer_sizes(tor_tls_t *tls, size_t *rbuf_capacity, size_t *rbuf_bytes, size_t *wbuf_capacity, size_t *wbuf_bytes) { +#if OPENSSL_VERSION_NUMBER >= OPENSSL_V_SERIES(1,1,0) + (void)tls; + (void)rbuf_capacity; + (void)rbuf_bytes; + (void)wbuf_capacity; + (void)wbuf_bytes; + + return -1; +#else if (tls->ssl->s3->rbuf.buf) *rbuf_capacity = tls->ssl->s3->rbuf.len; else @@ -2891,6 +2902,8 @@ tor_tls_get_buffer_sizes(tor_tls_t *tls, *wbuf_capacity = 0; *rbuf_bytes = tls->ssl->s3->rbuf.left; *wbuf_bytes = tls->ssl->s3->wbuf.left; + return 0; +#endif } #ifdef USE_BUFFEREVENTS diff --git a/src/common/tortls.h b/src/common/tortls.h index f8c6d59..5e1606f 100644 --- a/src/common/tortls.h +++ b/src/common/tortls.h @@ -92,7 +92,7 @@ size_t tor_tls_get_forced_write_size(tor_tls_t *tls); void tor_tls_get_n_raw_bytes(tor_tls_t *tls, size_t *n_read, size_t *n_written); -void tor_tls_get_buffer_sizes(tor_tls_t *tls, +int tor_tls_get_buffer_sizes(tor_tls_t *tls, size_t *rbuf_capacity, size_t *rbuf_bytes, size_t *wbuf_capacity, size_t *wbuf_bytes); diff --git a/src/or/main.c b/src/or/main.c index d0fe8cb..651291b 100644 --- a/src/or/main.c +++ b/src/or/main.c @@ -2315,12 +2315,13 @@ dumpstats(int severity) if (conn->type == CONN_TYPE_OR) { or_connection_t *or_conn = TO_OR_CONN(conn); if (or_conn->tls) { - tor_tls_get_buffer_sizes(or_conn->tls, &rbuf_cap, &rbuf_len, - &wbuf_cap, &wbuf_len); - tor_log(severity, LD_GENERAL, - "Conn %d: %d/%d bytes used on OpenSSL read buffer; " - "%d/%d bytes used on write buffer.", - i, (int)rbuf_len, (int)rbuf_cap, (int)wbuf_len, (int)wbuf_cap); + if (tor_tls_get_buffer_sizes(or_conn->tls, &rbuf_cap, &rbuf_len, + &wbuf_cap, &wbuf_len) == 0) { + tor_log(severity, LD_GENERAL, + "Conn %d: %d/%d bytes used on OpenSSL read buffer; " + "%d/%d bytes used on write buffer.", + i, (int)rbuf_len, (int)rbuf_cap, (int)wbuf_len, (int)wbuf_cap); + } } } }

1 0

[tor/master] Now that OpenSSL 0.9.8 is dead, crypto_seed_rng() needs no args
by nickm＠torproject.org 20 May '15

20 May '15

commit f8f407d66a4389035852a229a6945cc08a64b198 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue May 19 16:17:03 2015 -0400 Now that OpenSSL 0.9.8 is dead, crypto_seed_rng() needs no args It needed an argument before because it wasn't safe to call RAND_poll() on openssl 0.9.8c if you had already opened more fds than would fit in fd_set. --- src/common/crypto.c | 8 +++----- src/common/crypto.h | 2 +- src/or/main.c | 2 +- src/test/bench.c | 2 +- src/test/test_crypto.c | 2 +- src/test/test_workqueue.c | 2 +- src/test/testing_common.c | 2 +- src/tools/tor-gencert.c | 2 +- 8 files changed, 10 insertions(+), 12 deletions(-) diff --git a/src/common/crypto.c b/src/common/crypto.c index 0feed1c..f980d7e 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -302,7 +302,7 @@ crypto_early_init(void) crypto_force_rand_ssleay(); - if (crypto_seed_rng(1) < 0) + if (crypto_seed_rng() < 0) return -1; if (crypto_init_siphash_key() < 0) return -1; @@ -384,7 +384,7 @@ crypto_global_init(int useAccel, const char *accelName, const char *accelDir) } if (crypto_force_rand_ssleay()) { - if (crypto_seed_rng(1) < 0) + if (crypto_seed_rng() < 0) return -1; } @@ -2485,13 +2485,11 @@ crypto_strongest_rand(uint8_t *out, size_t out_len) * have not yet allocated a bunch of fds. Return 0 on success, -1 on failure. */ int -crypto_seed_rng(int startup) +crypto_seed_rng(void) { int rand_poll_ok = 0, load_entropy_ok = 0; uint8_t buf[ADD_ENTROPY]; - (void) startup; - /* OpenSSL has a RAND_poll function that knows about more kinds of * entropy than we do. We'll try calling that, *and* calling our own entropy * functions. If one succeeds, we'll accept the RNG as seeded. */ diff --git a/src/common/crypto.h b/src/common/crypto.h index d305bc1..5a08045 100644 --- a/src/common/crypto.h +++ b/src/common/crypto.h @@ -251,7 +251,7 @@ int crypto_expand_key_material_rfc5869_sha256( uint8_t *key_out, size_t key_out_len); /* random numbers */ -int crypto_seed_rng(int startup); +int crypto_seed_rng(void); MOCK_DECL(int,crypto_rand,(char *to, size_t n)); int crypto_strongest_rand(uint8_t *out, size_t out_len); int crypto_rand_int(unsigned int max); diff --git a/src/or/main.c b/src/or/main.c index 651291b..3f785a2 100644 --- a/src/or/main.c +++ b/src/or/main.c @@ -1317,7 +1317,7 @@ run_scheduled_events(time_t now) if (time_to_add_entropy < now) { if (time_to_add_entropy) { /* We already seeded once, so don't die on failure. */ - crypto_seed_rng(0); + crypto_seed_rng(); } /** How often do we add more entropy to OpenSSL's RNG pool? */ #define ENTROPY_INTERVAL (60*60) diff --git a/src/test/bench.c b/src/test/bench.c index 6909e73..a74fc77 100644 --- a/src/test/bench.c +++ b/src/test/bench.c @@ -624,7 +624,7 @@ main(int argc, const char **argv) reset_perftime(); - crypto_seed_rng(1); + crypto_seed_rng(); crypto_init_siphash_key(); options = options_new(); init_logging(1); diff --git a/src/test/test_crypto.c b/src/test/test_crypto.c index e9fb8bf..5c263ba 100644 --- a/src/test/test_crypto.c +++ b/src/test/test_crypto.c @@ -72,7 +72,7 @@ test_crypto_rng(void *arg) /* Try out RNG. */ (void)arg; - tt_assert(! crypto_seed_rng(0)); + tt_assert(! crypto_seed_rng()); crypto_rand(data1, 100); crypto_rand(data2, 100); tt_mem_op(data1,OP_NE, data2,100); diff --git a/src/test/test_workqueue.c b/src/test/test_workqueue.c index aaff506..c524b24 100644 --- a/src/test/test_workqueue.c +++ b/src/test/test_workqueue.c @@ -356,7 +356,7 @@ main(int argc, char **argv) init_logging(1); crypto_global_init(1, NULL, NULL); - crypto_seed_rng(1); + crypto_seed_rng(); rq = replyqueue_new(as_flags); tor_assert(rq); diff --git a/src/test/testing_common.c b/src/test/testing_common.c index 403c83b..e0c0046 100644 --- a/src/test/testing_common.c +++ b/src/test/testing_common.c @@ -270,7 +270,7 @@ main(int c, const char **v) return 1; } crypto_set_tls_dh_prime(NULL); - crypto_seed_rng(1); + crypto_seed_rng(); rep_hist_init(); network_init(); setup_directory(); diff --git a/src/tools/tor-gencert.c b/src/tools/tor-gencert.c index c599822..b83682a 100644 --- a/src/tools/tor-gencert.c +++ b/src/tools/tor-gencert.c @@ -532,7 +532,7 @@ main(int argc, char **argv) fprintf(stderr, "Couldn't initialize crypto library.\n"); return 1; } - if (crypto_seed_rng(1)) { + if (crypto_seed_rng()) { fprintf(stderr, "Couldn't seed RNG.\n"); goto done; }

1 0

[tor/master] Tweak rectify_client_ciphers to work with openssl 1.1
by nickm＠torproject.org 20 May '15

20 May '15

commit 2f7c9b6ecb1a7855167b2c65781b2c4b1b014807 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed May 13 12:38:17 2015 -0400 Tweak rectify_client_ciphers to work with openssl 1.1 The key here is to never touch ssl->cipher_list directly, but only via SSL_get_ciphers(). But it's not so simple. See, if there is no specialized cipher_list on the SSL object, SSL_get_ciphers returns the cipher_list on the SSL_CTX. But we sure don't want to modify that one! So we need to use SSL_set_cipher_list first to make sure that we really have a cipher list on the SSL object. --- src/common/tortls.c | 55 ++++++++++++++++++++++++++++++++++++--------------- 1 file changed, 39 insertions(+), 16 deletions(-) diff --git a/src/common/tortls.c b/src/common/tortls.c index 97352c0..08966b6 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -1800,21 +1800,46 @@ log_unsupported_ciphers(smartlist_t *unsupported) tor_free(joined); } -/** Replace *ciphers with a new list of SSL ciphersuites: specifically, - * a list designed to mimic a common web browser. We might not be able to do - * that if OpenSSL doesn't support all the ciphers we want. Some of the - * ciphers in the list won't actually be implemented by OpenSSL: that's okay - * so long as the server doesn't select them. +static void +set_ssl_ciphers_to_list(SSL *ssl, STACK_OF(SSL_CIPHER) *stack) +{ + STACK_OF(SSL_CIPHER) *ciphers; + + int r, i; + /* #1: ensure that the ssl object has its own list of ciphers. Otherwise we + * might be about to stomp the SSL_CTX ciphers list. */ + r = SSL_set_cipher_list(ssl, "HIGH"); + tor_assert(r); + + /* #2: Grab ssl_ciphers and clear it. */ + ciphers = SSL_get_ciphers(ssl); + tor_assert(ciphers); + sk_SSL_CIPHER_zero(ciphers); + + /* #3: Copy the elements from stack. */ + for (i = 0; i < sk_SSL_CIPHER_num(stack); ++i) { + SSL_CIPHER *c = sk_SSL_CIPHER_value(stack, i); + sk_SSL_CIPHER_push(ciphers, c); + } +} + +/** Replace the ciphers on ssl with a new list of SSL ciphersuites: + * specifically, a list designed to mimic a common web browser. We might not + * be able to do that if OpenSSL doesn't support all the ciphers we want. + * Some of the ciphers in the list won't actually be implemented by OpenSSL: + * that's okay so long as the server doesn't select them. * * [If the server does select a bogus cipher, we won't crash or * anything; we'll just fail later when we try to look up the cipher in * ssl->cipher_list_by_id.] */ static void -rectify_client_ciphers(STACK_OF(SSL_CIPHER) **ciphers) +rectify_client_ciphers(SSL *ssl) { #ifdef V2_HANDSHAKE_CLIENT if (PREDICT_UNLIKELY(!CLIENT_CIPHER_STACK)) { + STACK_OF(SSL_CIPHER) *ciphers = SSL_get_ciphers(ssl); + /* We need to set CLIENT_CIPHER_STACK to an array of the ciphers * we want to use/advertise. */ int i = 0, j = 0; @@ -1835,21 +1860,21 @@ rectify_client_ciphers(STACK_OF(SSL_CIPHER) **ciphers) tor_assert(CLIENT_CIPHER_STACK); log_debug(LD_NET, "List was: %s", CLIENT_CIPHER_LIST); - for (j = 0; j < sk_SSL_CIPHER_num(*ciphers); ++j) { - SSL_CIPHER *cipher = sk_SSL_CIPHER_value(*ciphers, j); + for (j = 0; j < sk_SSL_CIPHER_num(ciphers); ++j) { + SSL_CIPHER *cipher = sk_SSL_CIPHER_value(ciphers, j); log_debug(LD_NET, "Cipher %d: %lx %s", j, cipher->id, cipher->name); } /* Then copy as many ciphers as we can from the good list, inserting * dummies as needed. Let j be an index into list of ciphers we have - * (*ciphers) and let i be an index into the ciphers we want + * (ciphers) and let i be an index into the ciphers we want * (CLIENT_INFO_CIPHER_LIST). We are building a list of ciphers in * CLIENT_CIPHER_STACK. */ for (i = j = 0; i < N_CLIENT_CIPHERS; ) { SSL_CIPHER *cipher = NULL; - if (j < sk_SSL_CIPHER_num(*ciphers)) - cipher = sk_SSL_CIPHER_value(*ciphers, j); + if (j < sk_SSL_CIPHER_num(ciphers)) + cipher = sk_SSL_CIPHER_value(ciphers, j); if (cipher && ((cipher->id >> 24) & 0xff) != 3) { /* Skip over non-v3 ciphers entirely. (This should no longer be * needed, thanks to saying !SSLv2 above.) */ @@ -1886,12 +1911,10 @@ rectify_client_ciphers(STACK_OF(SSL_CIPHER) **ciphers) smartlist_free(unsupported); } - sk_SSL_CIPHER_free(*ciphers); - *ciphers = sk_SSL_CIPHER_dup(CLIENT_CIPHER_STACK); - tor_assert(*ciphers); + set_ssl_ciphers_to_list(ssl, CLIENT_CIPHER_STACK); #else - (void)ciphers; + (void)ciphers; #endif } @@ -1935,7 +1958,7 @@ tor_tls_new(int sock, int isServer) goto err; } if (!isServer) - rectify_client_ciphers(&result->ssl->cipher_list); + rectify_client_ciphers(result->ssl); result->socket = sock; bio = BIO_new_socket(sock, BIO_NOCLOSE); if (! bio) {

1 0

[tor/master] SSL_clear_mode exists; we can use it.
by nickm＠torproject.org 20 May '15

20 May '15

commit 92b297bb589e51e2f2653dd9c1a8dc1a86b6b7ad Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed May 13 11:21:38 2015 -0400 SSL_clear_mode exists; we can use it. --- src/common/tortls.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/common/tortls.c b/src/common/tortls.c index a90ae70..4a15670 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -2239,8 +2239,7 @@ tor_tls_finish_handshake(tor_tls_t *tls) if (tls->isServer) { SSL_set_info_callback(tls->ssl, NULL); SSL_set_verify(tls->ssl, SSL_VERIFY_PEER, always_accept_verify_cb); - /* There doesn't seem to be a clear OpenSSL API to clear mode flags. */ - tls->ssl->mode &= ~SSL_MODE_NO_AUTO_CHAIN; + SSL_clear_mode(tls->ssl, SSL_MODE_NO_AUTO_CHAIN); #ifdef V2_HANDSHAKE_SERVER if (tor_tls_client_is_using_v2_ciphers(tls->ssl)) { /* This check is redundant, but back when we did it in the callback,

1 0

[tor/master] Stop accessing 'ssl->s3->flags' when we are using openssl 1.1
by nickm＠torproject.org 20 May '15

20 May '15

commit fa63f991c06e9753108a57e2a26a62da6e78e822 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed May 13 11:19:19 2015 -0400 Stop accessing 'ssl->s3->flags' when we are using openssl 1.1 This field was only needed to work with the now-long-gone (I hope, except for some horrible apples) openssl 0.9.8l; if your headers say you have openssl 1.1, you won't even need it. --- src/common/tortls.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/src/common/tortls.c b/src/common/tortls.c index 97a82bf..a90ae70 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -120,6 +120,13 @@ static int use_unsafe_renegotiation_op = 0; /** Does the run-time openssl version look like we need * SSL3_FLAGS_ALLOW_UNSAFE_LEGACY_RENEGOTIATION? */ static int use_unsafe_renegotiation_flag = 0; +#if OPENSSL_VERSION_NUMBER < OPENSSL_V_SERIES(1,1,0) +/* If we have openssl 1.1, we just trust that the "mode" will work, and don't + * use the "flag" at all. Nobody would forward-port that weird little glitch + * from 0.9.8l to 1.1, would they? + */ +#define SUPPORT_UNSAFE_RENEGOTIATION_FLAG +#endif /** Structure that we use for a single certificate. */ struct tor_cert_t { @@ -1713,7 +1720,7 @@ tor_tls_server_info_callback(const SSL *ssl, int type, int val) if (tls) { tls->wasV2Handshake = 1; -#ifdef USE_BUFFEREVENTS +#if (defined(USE_BUFFEREVENTS) && defined(SUPPORT_UNSAFE_RENEGOTATION_FLAG)) if (use_unsafe_renegotiation_flag) tls->ssl->s3->flags |= SSL3_FLAGS_ALLOW_UNSAFE_LEGACY_RENEGOTIATION; #endif @@ -2018,9 +2025,11 @@ tor_tls_unblock_renegotiation(tor_tls_t *tls) { /* Yes, we know what we are doing here. No, we do not treat a renegotiation * as authenticating any earlier-received data. */ +#ifdef SUPPORT_UNSAFE_RENEGOTIATION_FLAG if (use_unsafe_renegotiation_flag) { tls->ssl->s3->flags |= SSL3_FLAGS_ALLOW_UNSAFE_LEGACY_RENEGOTIATION; } +#endif if (use_unsafe_renegotiation_op) { SSL_set_options(tls->ssl, SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION); @@ -2034,17 +2043,23 @@ tor_tls_unblock_renegotiation(tor_tls_t *tls) void tor_tls_block_renegotiation(tor_tls_t *tls) { +#ifdef SUPPORT_UNSAFE_RENEGOTIATION_FLAG tls->ssl->s3->flags &= ~SSL3_FLAGS_ALLOW_UNSAFE_LEGACY_RENEGOTIATION; +#else + (void) tls; +#endif } /** Assert that the flags that allow legacy renegotiation are still set */ void tor_tls_assert_renegotiation_unblocked(tor_tls_t *tls) { +#ifdef SUPPORT_UNSAFE_RENEGOTIATION_FLAG if (use_unsafe_renegotiation_flag) { tor_assert(0 != (tls->ssl->s3->flags & SSL3_FLAGS_ALLOW_UNSAFE_LEGACY_RENEGOTIATION)); } +#endif if (use_unsafe_renegotiation_op) { long options = SSL_get_options(tls->ssl); tor_assert(0 != (options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION));

1 0

[tor/master] ERR_remove_state() is deprecated since OpenSSL 1.0.0.
by nickm＠torproject.org 20 May '15

20 May '15

commit 53a347592aa5311f8910125cef1d1814cd7088d5 Author: Yawning Angel <yawning(a)schwanenlied.me> Date: Thu Apr 23 10:56:31 2015 +0000 ERR_remove_state() is deprecated since OpenSSL 1.0.0. OpenSSL 1.1.0 must be built with "enable-deprecated", and compiled with `OPENSSL_USE_DEPRECATED` for this to work, so instead, use the newer routine as appropriate. --- src/common/crypto.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/common/crypto.c b/src/common/crypto.c index 218c7be..a68294a 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -405,7 +405,11 @@ crypto_global_init(int useAccel, const char *accelName, const char *accelDir) void crypto_thread_cleanup(void) { +#if OPENSSL_VERSION_NUMBER >= OPENSSL_V_SERIES(1,1,0) + ERR_remove_thread_state(NULL); +#else ERR_remove_state(0); +#endif } /** used by tortls.c: wrap an RSA* in a crypto_pk_t. */ @@ -3157,7 +3161,11 @@ int crypto_global_cleanup(void) { EVP_cleanup(); +#if OPENSSL_VERSION_NUMBER >= OPENSSL_V_SERIES(1,1,0) + ERR_remove_thread_state(NULL); +#else ERR_remove_state(0); +#endif ERR_free_strings(); if (dh_param_p)

1 0

[tor/master] Use SSL_state() to inspect the state of SSL objects.
by nickm＠torproject.org 20 May '15

20 May '15

commit 34451c7a453564f16194cf060444785fea2f971e Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed May 13 11:29:33 2015 -0400 Use SSL_state() to inspect the state of SSL objects. --- src/common/tortls.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/src/common/tortls.c b/src/common/tortls.c index 6093286..edb744f 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -1682,14 +1682,17 @@ static void tor_tls_server_info_callback(const SSL *ssl, int type, int val) { tor_tls_t *tls; + int ssl_state; (void) val; tor_tls_debug_state_callback(ssl, type, val); if (type != SSL_CB_ACCEPT_LOOP) return; - if ((ssl->state != SSL3_ST_SW_SRVR_HELLO_A) && - (ssl->state != SSL3_ST_SW_SRVR_HELLO_B)) + + ssl_state = SSL_state(ssl); + if ((ssl_state != SSL3_ST_SW_SRVR_HELLO_A) && + (ssl_state != SSL3_ST_SW_SRVR_HELLO_B)) return; tls = tor_tls_get_by_ssl(ssl); @@ -2194,7 +2197,7 @@ tor_tls_handshake(tor_tls_t *tls) tor_assert(tls->ssl); tor_assert(tls->state == TOR_TLS_ST_HANDSHAKE); check_no_tls_errors(); - oldstate = tls->ssl->state; + oldstate = SSL_state(tls->ssl); if (tls->isServer) { log_debug(LD_HANDSHAKE, "About to call SSL_accept on %p (%s)", tls, SSL_state_string_long(tls->ssl)); @@ -2204,7 +2207,7 @@ tor_tls_handshake(tor_tls_t *tls) SSL_state_string_long(tls->ssl)); r = SSL_connect(tls->ssl); } - if (oldstate != tls->ssl->state) + if (oldstate != SSL_state(tls->ssl)) log_debug(LD_HANDSHAKE, "After call, %p was in state %s", tls, SSL_state_string_long(tls->ssl)); /* We need to call this here and not earlier, since OpenSSL has a penchant

1 0

[tor/master] Use SSL_clear_mode where available.
by nickm＠torproject.org 20 May '15

20 May '15

commit 22da5001b5c1fbd3230176d389fab12cb86a69bc Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed May 13 11:24:47 2015 -0400 Use SSL_clear_mode where available. --- src/common/tortls.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/common/tortls.c b/src/common/tortls.c index 4a15670..6093286 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -2223,6 +2223,14 @@ tor_tls_handshake(tor_tls_t *tls) return r; } +/* SSL_clear_mode was introduced in 0.9.8m */ +#ifndef SSL_clear_mode +static void SSL_clear_mode(SSL *s, unsigned long m) +{ + s->mode &= ~m; +} +#endif + /** Perform the final part of the intial TLS handshake on tls. This * should be called for the first handshake only: it determines whether the v1 * or the v2 handshake was used, and adjusts things for the renegotiation

1 0

[translation/torbutton-torbuttondtd] Update translations for torbutton-torbuttondtd
by translation＠torproject.org 20 May '15

20 May '15

commit 098691c301d27bd01a956f2ae42be623177f075c Author: Translation commit bot <translation(a)torproject.org> Date: Wed May 20 16:16:04 2015 +0000 Update translations for torbutton-torbuttondtd --- id/torbutton.dtd | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/id/torbutton.dtd b/id/torbutton.dtd index 24f6437..a95a6fa 100644 --- a/id/torbutton.dtd +++ b/id/torbutton.dtd @@ -149,19 +149,19 @@ <!ENTITY torbutton.prefs.priv_caption "Pengaturan Privasi"> <!ENTITY torbutton.prefs.block_disk "Don't record browsing history or website data (enables Private Browsing Mode)"> <!ENTITY torbutton.prefs.restrict_thirdparty "Restrict third party cookies and other tracking data"> -<!ENTITY torbutton.prefs.block_plugins "Disable browser plugins (such as Flash)"> -<!ENTITY torbutton.prefs.resist_fingerprinting "Change details that distinguish you from other Tor Browser users"> -<!ENTITY torbutton.prefs.sec_caption "Level Keamanan"> -<!ENTITY torbutton.prefs.sec_low "Rendah (baku)"> -<!ENTITY torbutton.prefs.sec_low_usable_desc "This provides the most usable experience."> -<!ENTITY torbutton.prefs.sec_low_desc "At this security level, all browser features are enabled."> -<!ENTITY torbutton.prefs.sec_font_rend_svg_tooltip "The SVG OpenType font rendering mechanism is disabled."> +<!ENTITY torbutton.prefs.block_plugins "Nonaktifkan ..."> +<!ENTITY torbutton.prefs.resist_fingerprinting "Ubah rincian yang membedakan Anda dari pengguna peramban Tor lain."> +<!ENTITY torbutton.prefs.sec_caption "Tingkat Keamanan"> +<!ENTITY torbutton.prefs.sec_low "Rendah (default)"> +<!ENTITY torbutton.prefs.sec_low_usable_desc "Memberikan pengalaman paling umum."> +<!ENTITY torbutton.prefs.sec_low_desc "Pada tingkat keamanan ini, semua fitur peramban diaktifkan."> +<!ENTITY torbutton.prefs.sec_font_rend_svg_tooltip "Font OpenType SVG dinonaktifkan."> <!ENTITY torbutton.prefs.sec_med_low "Menengah-Rendah"> <!ENTITY torbutton.prefs.sec_gen_desc "Pada tingkat keamanan ini, perubahan berikut berlaku (seret kursor untuk rincian):"> <!ENTITY torbutton.prefs.sec_html5_desc "Video HTML5 dan audio menjadi Klik-untuk-Menjalankan melalui NoScript."> <!ENTITY torbutton.prefs.sec_html5_tooltip "Pada beberapa situs, Anda mungkin perlu memakai tombol NoScript untuk mengaktifkan obyek media ini."> <!ENTITY torbutton.prefs.sec_some_jit_desc "Beberapa performa JavaScript dinonaktifkan."> -<!ENTITY torbutton.prefs.sec_jit_desc_tooltip "ION JIT, Type Inference, ASM.JS."> +<!ENTITY torbutton.prefs.sec_jit_desc_tooltip "ION JIT, Tipe Simpulan, ASM.JS."> <!ENTITY torbutton.prefs.sec_baseline_jit_desc_tooltip "Garis dasar JIT."> <!ENTITY torbutton.prefs.sec_jit_slower_desc "Script pada beberapa situs mungkin pelan."> <!ENTITY torbutton.prefs.sec_jar_desc "Berkas rimut JAR diblokir.">

1 0