February 2016 - tor-commits - lists.torproject.org

[tor/master] Revise some more changelog entries
by nickm＠torproject.org 04 Feb '16

04 Feb '16

commit 08788a81bc4ab3653e95bb8a7e727a28c53b7342 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Feb 3 20:24:00 2016 -0500 Revise some more changelog entries --- ChangeLog | 31 +++++++++++++++++-------------- changes/bug17921_bug17984 | 4 ---- 2 files changed, 17 insertions(+), 18 deletions(-) diff --git a/ChangeLog b/ChangeLog index 44d4c88..7d55071 100644 --- a/ChangeLog +++ b/ChangeLog @@ -86,26 +86,29 @@ Changes in version 0.2.8.1-alpha - 2016-02-0? that have them. Closes ticket 13696. o Minor features (accounting): - - Added two modes to AccountingRule in torrc for limiting just the - number of bytes sent ("AccountingRule out") or the number of bytes + - Added two modes to the AccountingRule option: One for limiting only + the number of bytes sent ("AccountingRule out"), and one for + limiting only the number of bytes received ("AccountingRule in"). Closes ticket 15989; patch from "unixninja92". o Minor features (build): - - Since our build process now uses 'make distcheck', we no longer + - Since our build process now uses "make distcheck", we no longer force "make dist" to depend on "make check". Closes ticket 17893; patch from "cypherpunks." - - Repair some compilation issues with some recent (unreleased, - alpha) versions of OpenSSL 1.1. Closes ticket 17549. + - Tor now builds successfully with the recent OpenSSL 1.1 + development branch, and with the latest LibreSSL. Closes tickets + 17549, 17921, and 17984. o Minor features (controller): - - Adds FallbackDir entries to 'GETINFO config/defaults'. Closes + - Adds the FallbackDir entries to 'GETINFO config/defaults'. Closes tickets 16774 and 17817. Patch by George Tankersley. - - New "GETINFO hs/service/desc/id/" command to retrieve a hidden + - New 'GETINFO hs/service/desc/id/' command to retrieve a hidden service descriptor from a service's local hidden service descriptor cache. Closes ticket 14846. - - Add controller getinfo exit-policy/reject-private/[default,relay] - for the reject rules added by ExitPolicyRejectPrivate. This makes + - Add 'GETINFO exit-policy/reject-private/[default,relay]', so + controllers can examine the + the reject rules added by ExitPolicyRejectPrivate. This makes it easier for stem to display exit policies. o Minor features (crypto): @@ -113,20 +116,20 @@ Changes in version 0.2.8.1-alpha - 2016-02-0? George Tankersley. - Add SHA3 and SHAKE support to crypto.c. Closes ticket 17783. - When allocating a digest state object, allocate no more space than - we actually need. Previously, we were allocating as much space as + we actually need. Previously, we would allocate as much space as the state for the largest algorithm would need. This change saves up to 672 bytes per circuit. Closes ticket 17796. - Improve performance when hashing non-multiple of 8 sized buffers, - based on Andrew Moon's Public Domain SipHash-2-4 implementation. + based on Andrew Moon's public domain SipHash-2-4 implementation. Fixes bug 17544; bugfix on 0.2.5.3-alpha. o Minor features (directory downloads): - - Wait for busy authorities and fallbacks to become non-busy when + - Wait for busy authorities and fallback directories to become non-busy when bootstrapping. (A similar change was made in 6c443e987d for - directory servers chosen from the consensus.) Closes ticket 17864; + directory caches chosen from the consensus.) Closes ticket 17864; patch by "teor". - Add UseDefaultFallbackDirs, which enables any hard-coded fallback - directory mirrors. Default is 1, set it to 0 to disable fallbacks. + directory mirrors. The default is 1; set it to 0 to disable fallbacks. Implements ticket 17576. Patch by "teor". o Minor features (geoip): diff --git a/changes/bug17921_bug17984 b/changes/bug17921_bug17984 deleted file mode 100644 index f254e29..0000000 --- a/changes/bug17921_bug17984 +++ /dev/null @@ -1,4 +0,0 @@ - o Minor features (compilation): - - Tor builds successfully with the unreleased OpenSSL 1.1 alpha - releases, and with the latest LibreSSL. Closes tickets 17921 and - 17984.

1 0

[tor-browser-bundle/hardened-builds] Fix typo in bridges configuration
by gk＠torproject.org 03 Feb '16

03 Feb '16

commit 8503a7602b8123ac9a9900fd414accac2f67f86b Author: Nicolas Vigier <boklm(a)torproject.org> Date: Wed Feb 3 18:06:37 2016 +0100 Fix typo in bridges configuration --- Bundle-Data/PTConfigs/bridge_prefs.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Bundle-Data/PTConfigs/bridge_prefs.js b/Bundle-Data/PTConfigs/bridge_prefs.js index adb5c98..8990c84 100644 --- a/Bundle-Data/PTConfigs/bridge_prefs.js +++ b/Bundle-Data/PTConfigs/bridge_prefs.js @@ -28,8 +28,8 @@ pref("extensions.torlauncher.default_bridge.obfs4.5", "obfs4 83.212.101.3:41213 pref("extensions.torlauncher.default_bridge.obfs4.6", "obfs4 104.131.108.182:56880 EF577C30B9F788B0E1801CF7E433B3B77792B77A cert=0SFhfDQrKjUJP8Qq6wrwSICEPf3Vl/nJRsYxWbg3QRoSqhl2EB78MPS2lQxbXY4EW1wwXA iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.7", "obfs4 109.105.109.147:13764 BBB28DF0F201E706BE564EFE690FE9577DD8386D cert=KfMQN/tNMFdda61hMgpiMI7pbwU1T+wxjTulYnfw+4sgvG0zSH7N7fwT10BI8MUdAD7iJA iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.8", "obfs4 154.35.22.11:49868 A832D176ECD5C7C6B58825AE22FC4C90FA249637 cert=YPbQqXPiqTUBfjGFLpm9JYEFTBvnzEJDKJxXG5Sxzrr/v2qrhGU4Jls9lHjLAhqpXaEfZw iat-mode=0"); -pref("extensions.torlauncher.default_bridge.obfs4.9”, "obfs4 154.35.22.12:80 00DC6C4FA49A65BD1472993CF6730D54F11E0DBB cert=N86E9hKXXXVz6G7w2z8wFfhIDztDAzZ/3poxVePHEYjbKDWzjkRDccFMAnhK75fc65pYSg iat-mode=0"); -pref("extensions.torlauncher.default_bridge.obfs4.10”, "obfs4 154.35.22.13:443 FE7840FE1E21FE0A0639ED176EDA00A3ECA1E34D cert=fKnzxr+m+jWXXQGCaXe4f2gGoPXMzbL+bTBbXMYXuK0tMotd+nXyS33y2mONZWU29l81CA iat-mode=0"); +pref("extensions.torlauncher.default_bridge.obfs4.9", "obfs4 154.35.22.12:80 00DC6C4FA49A65BD1472993CF6730D54F11E0DBB cert=N86E9hKXXXVz6G7w2z8wFfhIDztDAzZ/3poxVePHEYjbKDWzjkRDccFMAnhK75fc65pYSg iat-mode=0"); +pref("extensions.torlauncher.default_bridge.obfs4.10", "obfs4 154.35.22.13:443 FE7840FE1E21FE0A0639ED176EDA00A3ECA1E34D cert=fKnzxr+m+jWXXQGCaXe4f2gGoPXMzbL+bTBbXMYXuK0tMotd+nXyS33y2mONZWU29l81CA iat-mode=0"); pref("extensions.torlauncher.default_bridge.meek-google.1", "meek 0.0.2.0:1 46D4A71197B8FA515A826C6B017C522FE264655B url=https://meek-reflect.appspot.com/ front=www.google.com"); pref("extensions.torlauncher.default_bridge.meek-amazon.1", "meek 0.0.2.0:2 B9E7141C594AF25699E0079C1F0146F409495296 url=https://d2zfqthxsdq309.cloudfront.net/ front=a0.awsstatic.com");

1 0

[tor-browser-bundle/master] Fix typo in bridges configuration
by gk＠torproject.org 03 Feb '16

03 Feb '16

commit 65398ba1a0c70640e749b7dc29d87d45129edbab Author: Nicolas Vigier <boklm(a)torproject.org> Date: Wed Feb 3 18:06:37 2016 +0100 Fix typo in bridges configuration --- Bundle-Data/PTConfigs/bridge_prefs.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Bundle-Data/PTConfigs/bridge_prefs.js b/Bundle-Data/PTConfigs/bridge_prefs.js index adb5c98..8990c84 100644 --- a/Bundle-Data/PTConfigs/bridge_prefs.js +++ b/Bundle-Data/PTConfigs/bridge_prefs.js @@ -28,8 +28,8 @@ pref("extensions.torlauncher.default_bridge.obfs4.5", "obfs4 83.212.101.3:41213 pref("extensions.torlauncher.default_bridge.obfs4.6", "obfs4 104.131.108.182:56880 EF577C30B9F788B0E1801CF7E433B3B77792B77A cert=0SFhfDQrKjUJP8Qq6wrwSICEPf3Vl/nJRsYxWbg3QRoSqhl2EB78MPS2lQxbXY4EW1wwXA iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.7", "obfs4 109.105.109.147:13764 BBB28DF0F201E706BE564EFE690FE9577DD8386D cert=KfMQN/tNMFdda61hMgpiMI7pbwU1T+wxjTulYnfw+4sgvG0zSH7N7fwT10BI8MUdAD7iJA iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.8", "obfs4 154.35.22.11:49868 A832D176ECD5C7C6B58825AE22FC4C90FA249637 cert=YPbQqXPiqTUBfjGFLpm9JYEFTBvnzEJDKJxXG5Sxzrr/v2qrhGU4Jls9lHjLAhqpXaEfZw iat-mode=0"); -pref("extensions.torlauncher.default_bridge.obfs4.9”, "obfs4 154.35.22.12:80 00DC6C4FA49A65BD1472993CF6730D54F11E0DBB cert=N86E9hKXXXVz6G7w2z8wFfhIDztDAzZ/3poxVePHEYjbKDWzjkRDccFMAnhK75fc65pYSg iat-mode=0"); -pref("extensions.torlauncher.default_bridge.obfs4.10”, "obfs4 154.35.22.13:443 FE7840FE1E21FE0A0639ED176EDA00A3ECA1E34D cert=fKnzxr+m+jWXXQGCaXe4f2gGoPXMzbL+bTBbXMYXuK0tMotd+nXyS33y2mONZWU29l81CA iat-mode=0"); +pref("extensions.torlauncher.default_bridge.obfs4.9", "obfs4 154.35.22.12:80 00DC6C4FA49A65BD1472993CF6730D54F11E0DBB cert=N86E9hKXXXVz6G7w2z8wFfhIDztDAzZ/3poxVePHEYjbKDWzjkRDccFMAnhK75fc65pYSg iat-mode=0"); +pref("extensions.torlauncher.default_bridge.obfs4.10", "obfs4 154.35.22.13:443 FE7840FE1E21FE0A0639ED176EDA00A3ECA1E34D cert=fKnzxr+m+jWXXQGCaXe4f2gGoPXMzbL+bTBbXMYXuK0tMotd+nXyS33y2mONZWU29l81CA iat-mode=0"); pref("extensions.torlauncher.default_bridge.meek-google.1", "meek 0.0.2.0:1 46D4A71197B8FA515A826C6B017C522FE264655B url=https://meek-reflect.appspot.com/ front=www.google.com"); pref("extensions.torlauncher.default_bridge.meek-amazon.1", "meek 0.0.2.0:2 B9E7141C594AF25699E0079C1F0146F409495296 url=https://d2zfqthxsdq309.cloudfront.net/ front=a0.awsstatic.com");

1 0

[tordnsel/master] sandboxed builds
by arlo＠torproject.org 03 Feb '16

03 Feb '16

commit 392bb98a397c1d5179c33befdd41a280f0525dfe Author: David Kaloper <david(a)numm.org> Date: Fri Aug 30 22:08:20 2013 +0200 sandboxed builds cabal >= 1.18 --- .gitignore | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index 1efea40..84ca43d 100644 --- a/.gitignore +++ b/.gitignore @@ -1,4 +1,5 @@ dist/ + .cabal-sandbox/ cabal.sandbox.config - +cabal.config

1 0

[tor-browser-bundle/maint-5.5] Fix typo in bridges configuration
by gk＠torproject.org 03 Feb '16

03 Feb '16

commit acf9efa76412e1fb5315b8859036928e503d96d0 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Wed Feb 3 18:06:37 2016 +0100 Fix typo in bridges configuration --- Bundle-Data/PTConfigs/bridge_prefs.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Bundle-Data/PTConfigs/bridge_prefs.js b/Bundle-Data/PTConfigs/bridge_prefs.js index adb5c98..8990c84 100644 --- a/Bundle-Data/PTConfigs/bridge_prefs.js +++ b/Bundle-Data/PTConfigs/bridge_prefs.js @@ -28,8 +28,8 @@ pref("extensions.torlauncher.default_bridge.obfs4.5", "obfs4 83.212.101.3:41213 pref("extensions.torlauncher.default_bridge.obfs4.6", "obfs4 104.131.108.182:56880 EF577C30B9F788B0E1801CF7E433B3B77792B77A cert=0SFhfDQrKjUJP8Qq6wrwSICEPf3Vl/nJRsYxWbg3QRoSqhl2EB78MPS2lQxbXY4EW1wwXA iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.7", "obfs4 109.105.109.147:13764 BBB28DF0F201E706BE564EFE690FE9577DD8386D cert=KfMQN/tNMFdda61hMgpiMI7pbwU1T+wxjTulYnfw+4sgvG0zSH7N7fwT10BI8MUdAD7iJA iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.8", "obfs4 154.35.22.11:49868 A832D176ECD5C7C6B58825AE22FC4C90FA249637 cert=YPbQqXPiqTUBfjGFLpm9JYEFTBvnzEJDKJxXG5Sxzrr/v2qrhGU4Jls9lHjLAhqpXaEfZw iat-mode=0"); -pref("extensions.torlauncher.default_bridge.obfs4.9”, "obfs4 154.35.22.12:80 00DC6C4FA49A65BD1472993CF6730D54F11E0DBB cert=N86E9hKXXXVz6G7w2z8wFfhIDztDAzZ/3poxVePHEYjbKDWzjkRDccFMAnhK75fc65pYSg iat-mode=0"); -pref("extensions.torlauncher.default_bridge.obfs4.10”, "obfs4 154.35.22.13:443 FE7840FE1E21FE0A0639ED176EDA00A3ECA1E34D cert=fKnzxr+m+jWXXQGCaXe4f2gGoPXMzbL+bTBbXMYXuK0tMotd+nXyS33y2mONZWU29l81CA iat-mode=0"); +pref("extensions.torlauncher.default_bridge.obfs4.9", "obfs4 154.35.22.12:80 00DC6C4FA49A65BD1472993CF6730D54F11E0DBB cert=N86E9hKXXXVz6G7w2z8wFfhIDztDAzZ/3poxVePHEYjbKDWzjkRDccFMAnhK75fc65pYSg iat-mode=0"); +pref("extensions.torlauncher.default_bridge.obfs4.10", "obfs4 154.35.22.13:443 FE7840FE1E21FE0A0639ED176EDA00A3ECA1E34D cert=fKnzxr+m+jWXXQGCaXe4f2gGoPXMzbL+bTBbXMYXuK0tMotd+nXyS33y2mONZWU29l81CA iat-mode=0"); pref("extensions.torlauncher.default_bridge.meek-google.1", "meek 0.0.2.0:1 46D4A71197B8FA515A826C6B017C522FE264655B url=https://meek-reflect.appspot.com/ front=www.google.com"); pref("extensions.torlauncher.default_bridge.meek-amazon.1", "meek 0.0.2.0:2 B9E7141C594AF25699E0079C1F0146F409495296 url=https://d2zfqthxsdq309.cloudfront.net/ front=a0.awsstatic.com");

1 0

[tordnsel/master] Placate cpp-options warning
by arlo＠torproject.org 03 Feb '16

03 Feb '16

commit bd0cd7376c7fd03a5e1802a6c2da2774426518bc Author: Arlo Breault <arlolra(a)gmail.com> Date: Wed Feb 3 11:57:16 2016 -0800 Placate cpp-options warning --- tordnsel.cabal | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tordnsel.cabal b/tordnsel.cabal index 8780326..b51252d 100644 --- a/tordnsel.cabal +++ b/tordnsel.cabal @@ -59,7 +59,8 @@ Other-Modules: TorDNSEL.Config, HS-Source-Dirs: src Includes: sys/types.h, unistd.h, sysexits.h, netinet/in.h, openssl/rand.h Extra-Libraries: crypto -GHC-Options: -O2 -Wall -Werror -DVERSION="0.1.1-dev" +GHC-Options: -O2 -Wall -Werror +CPP-Options: -DVERSION="0.1.1-dev" Executable: runtests Buildable: False

1 0

[tor/master] Make Tor build happily with OpenSSL master and libressl.
by nickm＠torproject.org 03 Feb '16

03 Feb '16

commit 27582325dc691f02c41612a258483a73f2e0e000 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Feb 3 11:13:12 2016 -0500 Make Tor build happily with OpenSSL master and libressl. Also tested with 1.0.0t and 1.0.2f. Closes ticket 19784. Closes most of 17921. (Still need to make some tests pass.) --- changes/bug17921_bug17984 | 4 ++++ src/common/aes.c | 31 +++++++++++++++---------------- src/common/aes.h | 1 - src/common/compat_openssl.h | 2 ++ src/common/crypto.c | 4 ++++ src/common/tortls.c | 16 +++++++++++----- src/common/tortls.h | 7 ++++--- src/test/test_crypto.c | 14 ++++++++++---- src/test/test_tortls.c | 9 ++++----- 9 files changed, 54 insertions(+), 34 deletions(-) diff --git a/changes/bug17921_bug17984 b/changes/bug17921_bug17984 new file mode 100644 index 0000000..f254e29 --- /dev/null +++ b/changes/bug17921_bug17984 @@ -0,0 +1,4 @@ + o Minor features (compilation): + - Tor builds successfully with the unreleased OpenSSL 1.1 alpha + releases, and with the latest LibreSSL. Closes tickets 17921 and + 17984. diff --git a/src/common/aes.c b/src/common/aes.c index 7b6cc39..89c99c1 100644 --- a/src/common/aes.c +++ b/src/common/aes.c @@ -81,47 +81,46 @@ #ifdef USE_EVP_AES_CTR -struct aes_cnt_cipher { - EVP_CIPHER_CTX evp; -}; +/* We don't actually define the struct here. */ aes_cnt_cipher_t * aes_new_cipher(const char *key, const char *iv) { - aes_cnt_cipher_t *cipher; - cipher = tor_malloc_zero(sizeof(aes_cnt_cipher_t)); - EVP_EncryptInit(&cipher->evp, EVP_aes_128_ctr(), + EVP_CIPHER_CTX *cipher = EVP_CIPHER_CTX_new(); + EVP_EncryptInit(cipher, EVP_aes_128_ctr(), (const unsigned char*)key, (const unsigned char *)iv); - return cipher; + return (aes_cnt_cipher_t *) cipher; } void -aes_cipher_free(aes_cnt_cipher_t *cipher) +aes_cipher_free(aes_cnt_cipher_t *cipher_) { - if (!cipher) + if (!cipher_) return; - EVP_CIPHER_CTX_cleanup(&cipher->evp); - memwipe(cipher, 0, sizeof(aes_cnt_cipher_t)); - tor_free(cipher); + EVP_CIPHER_CTX *cipher = (EVP_CIPHER_CTX *) cipher_; + EVP_CIPHER_CTX_cleanup(cipher); + EVP_CIPHER_CTX_free(cipher); } void -aes_crypt(aes_cnt_cipher_t *cipher, const char *input, size_t len, +aes_crypt(aes_cnt_cipher_t *cipher_, const char *input, size_t len, char *output) { int outl; + EVP_CIPHER_CTX *cipher = (EVP_CIPHER_CTX *) cipher_; tor_assert(len < INT_MAX); - EVP_EncryptUpdate(&cipher->evp, (unsigned char*)output, + EVP_EncryptUpdate(cipher, (unsigned char*)output, &outl, (const unsigned char *)input, (int)len); } void -aes_crypt_inplace(aes_cnt_cipher_t *cipher, char *data, size_t len) +aes_crypt_inplace(aes_cnt_cipher_t *cipher_, char *data, size_t len) { int outl; + EVP_CIPHER_CTX *cipher = (EVP_CIPHER_CTX *) cipher_; tor_assert(len < INT_MAX); - EVP_EncryptUpdate(&cipher->evp, (unsigned char*)data, + EVP_EncryptUpdate(cipher, (unsigned char*)data, &outl, (unsigned char*)data, (int)len); } int diff --git a/src/common/aes.h b/src/common/aes.h index df2f3aa..5500db7 100644 --- a/src/common/aes.h +++ b/src/common/aes.h @@ -13,7 +13,6 @@ * \brief Headers for aes.c */ -struct aes_cnt_cipher; typedef struct aes_cnt_cipher aes_cnt_cipher_t; aes_cnt_cipher_t* aes_new_cipher(const char *key, const char *iv); diff --git a/src/common/compat_openssl.h b/src/common/compat_openssl.h index 9c98181..d5333a2 100644 --- a/src/common/compat_openssl.h +++ b/src/common/compat_openssl.h @@ -35,9 +35,11 @@ (((st) == SSL3_ST_SW_SRVR_HELLO_A) || \ ((st) == SSL3_ST_SW_SRVR_HELLO_B)) #define OSSL_HANDSHAKE_STATE int +#define CONST_IF_OPENSSL_1_1_API #else #define STATE_IS_SW_SERVER_HELLO(st) \ ((st) == TLS_ST_SW_SRVR_HELLO) +#define CONST_IF_OPENSSL_1_1_API const #endif #endif diff --git a/src/common/crypto.c b/src/common/crypto.c index a42c461..bc659b1 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -373,8 +373,12 @@ crypto_global_init(int useAccel, const char *accelName, const char *accelDir) used by Tor and the set of algorithms available in the engine */ log_engine("RSA", ENGINE_get_default_RSA()); log_engine("DH", ENGINE_get_default_DH()); +#ifdef OPENSSL_1_1_API + log_engine("EC", ENGINE_get_default_EC()); +#else log_engine("ECDH", ENGINE_get_default_ECDH()); log_engine("ECDSA", ENGINE_get_default_ECDSA()); +#endif log_engine("RAND", ENGINE_get_default_RAND()); log_engine("RAND (which we will not use)", ENGINE_get_default_RAND()); log_engine("SHA1", ENGINE_get_digest_engine(NID_sha1)); diff --git a/src/common/tortls.c b/src/common/tortls.c index 6e4cd3d..5f84e5c 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -911,7 +911,7 @@ tor_tls_cert_is_valid(int severity, } else if (cert_key) { int min_bits = 1024; #ifdef EVP_PKEY_EC - if (EVP_PKEY_type(cert_key->type) == EVP_PKEY_EC) + if (EVP_PKEY_base_id(cert_key) == EVP_PKEY_EC) min_bits = 128; #endif if (EVP_PKEY_bits(cert_key) >= min_bits) @@ -1414,7 +1414,7 @@ tor_tls_classify_client_ciphers(const SSL *ssl, /* Now we need to see if there are any ciphers whose presence means we're * dealing with an updated Tor. */ for (i = 0; i < sk_SSL_CIPHER_num(peer_ciphers); ++i) { - SSL_CIPHER *cipher = sk_SSL_CIPHER_value(peer_ciphers, i); + const SSL_CIPHER *cipher = sk_SSL_CIPHER_value(peer_ciphers, i); const char *ciphername = SSL_CIPHER_get_name(cipher); if (strcmp(ciphername, TLS1_TXT_DHE_RSA_WITH_AES_128_SHA) && strcmp(ciphername, TLS1_TXT_DHE_RSA_WITH_AES_256_SHA) && @@ -1431,7 +1431,7 @@ tor_tls_classify_client_ciphers(const SSL *ssl, { const uint16_t *v2_cipher = v2_cipher_list; for (i = 0; i < sk_SSL_CIPHER_num(peer_ciphers); ++i) { - SSL_CIPHER *cipher = sk_SSL_CIPHER_value(peer_ciphers, i); + const SSL_CIPHER *cipher = sk_SSL_CIPHER_value(peer_ciphers, i); uint16_t id = SSL_CIPHER_get_id(cipher) & 0xffff; if (id == 0x00ff) /* extended renegotiation indicator. */ continue; @@ -1453,7 +1453,7 @@ tor_tls_classify_client_ciphers(const SSL *ssl, smartlist_t *elts = smartlist_new(); char *s; for (i = 0; i < sk_SSL_CIPHER_num(peer_ciphers); ++i) { - SSL_CIPHER *cipher = sk_SSL_CIPHER_value(peer_ciphers, i); + const SSL_CIPHER *cipher = sk_SSL_CIPHER_value(peer_ciphers, i); const char *ciphername = SSL_CIPHER_get_name(cipher); smartlist_add(elts, (char*)ciphername); } @@ -1562,7 +1562,8 @@ tor_tls_server_info_callback(const SSL *ssl, int type, int val) STATIC int tor_tls_session_secret_cb(SSL *ssl, void *secret, int *secret_len, STACK_OF(SSL_CIPHER) *peer_ciphers, - SSL_CIPHER **cipher, void *arg) + CONST_IF_OPENSSL_1_1_API SSL_CIPHER **cipher, + void *arg) { (void) secret; (void) secret_len; @@ -1733,8 +1734,13 @@ tor_tls_block_renegotiation(tor_tls_t *tls) void tor_tls_assert_renegotiation_unblocked(tor_tls_t *tls) { +#if defined(SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION) && \ + SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION != 0 long options = SSL_get_options(tls->ssl); tor_assert(0 != (options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION)); +#else + (void) tls; +#endif } /** Return whether this tls initiated the connect (client) or diff --git a/src/common/tortls.h b/src/common/tortls.h index 6a4ef9a..7239eb9 100644 --- a/src/common/tortls.h +++ b/src/common/tortls.h @@ -143,9 +143,10 @@ STATIC size_t SSL_SESSION_get_master_key(SSL_SESSION *s, uint8_t *out, STATIC void tor_tls_debug_state_callback(const SSL *ssl, int type, int val); STATIC void tor_tls_server_info_callback(const SSL *ssl, int type, int val); STATIC int tor_tls_session_secret_cb(SSL *ssl, void *secret, - int *secret_len, - STACK_OF(SSL_CIPHER) *peer_ciphers, - SSL_CIPHER **cipher, void *arg); + int *secret_len, + STACK_OF(SSL_CIPHER) *peer_ciphers, + CONST_IF_OPENSSL_1_1_API SSL_CIPHER **cipher, + void *arg); STATIC int find_cipher_by_id(const SSL *ssl, const SSL_METHOD *m, uint16_t cipher); MOCK_DECL(STATIC X509*, tor_tls_create_certificate,(crypto_pk_t *rsa, diff --git a/src/test/test_crypto.c b/src/test/test_crypto.c index fb21f3a..3244c21 100644 --- a/src/test/test_crypto.c +++ b/src/test/test_crypto.c @@ -1108,6 +1108,11 @@ test_crypto_digests(void *arg) crypto_pk_free(k); } +#ifndef OPENSSL_1_1_API +#define EVP_ENCODE_CTX_new() tor_malloc_zero(sizeof(EVP_ENCODE_CTX)) +#define EVP_ENCODE_CTX_free(ctx) tor_free(ctx) +#endif + /** Encode src into dest with OpenSSL's EVP Encode interface, returning the * length of the encoded data in bytes. */ @@ -1115,12 +1120,13 @@ static int base64_encode_evp(char *dest, char *src, size_t srclen) { const unsigned char *s = (unsigned char*)src; - EVP_ENCODE_CTX ctx; + EVP_ENCODE_CTX *ctx = EVP_ENCODE_CTX_new(); int len, ret; - EVP_EncodeInit(&ctx); - EVP_EncodeUpdate(&ctx, (unsigned char *)dest, &len, s, (int)srclen); - EVP_EncodeFinal(&ctx, (unsigned char *)(dest + len), &ret); + EVP_EncodeInit(ctx); + EVP_EncodeUpdate(ctx, (unsigned char *)dest, &len, s, (int)srclen); + EVP_EncodeFinal(ctx, (unsigned char *)(dest + len), &ret); + EVP_ENCODE_CTX_free(ctx); return ret+ len; } diff --git a/src/test/test_tortls.c b/src/test/test_tortls.c index 98f5fac..ce7e6bc 100644 --- a/src/test/test_tortls.c +++ b/src/test/test_tortls.c @@ -1347,11 +1347,10 @@ test_tortls_get_buffer_sizes(void *ignored) tls->ssl->s3->wbuf.offset = 0; tls->ssl->s3->wbuf.left = 43; + ret = tor_tls_get_buffer_sizes(tls, &rbuf_c, &rbuf_b, &wbuf_c, &wbuf_b); #if OPENSSL_VERSION_NUMBER >= OPENSSL_V_SERIES(1,1,0) - ret = tor_tls_get_buffer_sizes(NULL, NULL, NULL, NULL, NULL); tt_int_op(ret, OP_EQ, -1); #else - ret = tor_tls_get_buffer_sizes(tls, &rbuf_c, &rbuf_b, &wbuf_c, &wbuf_b); tt_int_op(ret, OP_EQ, 0); tt_int_op(rbuf_c, OP_EQ, 0); tt_int_op(wbuf_c, OP_EQ, 0); @@ -2594,14 +2593,14 @@ test_tortls_create_certificate(void *ignored) tt_assert(!ret); fixed_crypto_pk_get_evp_pkey_result_index = 0; - fixed_crypto_pk_get_evp_pkey_result[0] = tor_malloc_zero(sizeof(EVP_PKEY)); + fixed_crypto_pk_get_evp_pkey_result[0] = EVP_PKEY_new(); fixed_crypto_pk_get_evp_pkey_result[1] = NULL; ret = tor_tls_create_certificate(pk1, pk2, "hello", "hello2", 1); tt_assert(!ret); fixed_crypto_pk_get_evp_pkey_result_index = 0; - fixed_crypto_pk_get_evp_pkey_result[0] = tor_malloc_zero(sizeof(EVP_PKEY)); - fixed_crypto_pk_get_evp_pkey_result[1] = tor_malloc_zero(sizeof(EVP_PKEY)); + fixed_crypto_pk_get_evp_pkey_result[0] = EVP_PKEY_new(); + fixed_crypto_pk_get_evp_pkey_result[1] = EVP_PKEY_new(); ret = tor_tls_create_certificate(pk1, pk2, "hello", "hello2", 1); tt_assert(!ret);

1 0

[tor/master] Make tortls unit tests pass with LibreSSL.
by nickm＠torproject.org 03 Feb '16

03 Feb '16

commit fa52b6f075a8bb90a3f3a014ef7423940f8a20b7 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Feb 3 11:31:57 2016 -0500 Make tortls unit tests pass with LibreSSL. Part of the fix for 17921. --- src/common/tortls.c | 2 +- src/test/test_tortls.c | 24 +++++++++++++++++++----- 2 files changed, 20 insertions(+), 6 deletions(-) diff --git a/src/common/tortls.c b/src/common/tortls.c index 5f84e5c..827abc4 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -1338,7 +1338,7 @@ find_cipher_by_id(const SSL *ssl, const SSL_METHOD *m, uint16_t cipher) return c != NULL; } # endif -# if OPENSSL_VERSION_NUMBER < OPENSSL_V_SERIES(1,1,0) +# ifndef OPENSSL_1_1_API if (m && m->get_cipher && m->num_ciphers) { /* It would seem that some of the "let's-clean-up-openssl" forks have * removed the get_cipher_by_char function. Okay, so now you get a diff --git a/src/test/test_tortls.c b/src/test/test_tortls.c index ce7e6bc..71b3863 100644 --- a/src/test/test_tortls.c +++ b/src/test/test_tortls.c @@ -1600,12 +1600,19 @@ test_tortls_block_renegotiation(void *ignored) tls = tor_malloc_zero(sizeof(tor_tls_t)); tls->ssl = tor_malloc_zero(sizeof(SSL)); tls->ssl->s3 = tor_malloc_zero(sizeof(SSL3_STATE)); - tls->ssl->s3->flags = 0x0010; +#ifndef SUPPORT_UNSAFE_RENEGOTIATION_FLAG +#define SSL3_FLAGS_ALLOW_UNSAFE_LEGACY_RENEGOTIATION 0 +#endif - tor_tls_block_renegotiation(tls); + tls->ssl->s3->flags = SSL3_FLAGS_ALLOW_UNSAFE_LEGACY_RENEGOTIATION; - tt_assert(!(SSL_get_options(tls->ssl) & 0x0010)); + tor_tls_block_renegotiation(tls); +#ifndef OPENSSL_1_1_API + tt_assert(!(tls->ssl->s3->flags & + SSL3_FLAGS_ALLOW_UNSAFE_LEGACY_RENEGOTIATION)); +#endif + done: tor_free(tls->ssl->s3); tor_free(tls->ssl); @@ -1622,7 +1629,9 @@ test_tortls_unblock_renegotiation(void *ignored) tls->ssl = tor_malloc_zero(sizeof(SSL)); tor_tls_unblock_renegotiation(tls); - tt_assert(SSL_get_options(tls->ssl) & 0x00040000L); + tt_uint_op(SSL_get_options(tls->ssl) & + SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION, OP_EQ, + SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION); done: tor_free(tls->ssl); @@ -1906,6 +1915,7 @@ fixed_ssl_shutdown(SSL *s) return fixed_ssl_shutdown_result; } +#ifndef LIBRESSL_VERSION_NUMBER static int fixed_ssl_state_to_set; static tor_tls_t *fixed_tls; @@ -1923,6 +1933,7 @@ setting_version_and_state_ssl_shutdown(SSL *s) s->version = SSL2_VERSION; return fixed_ssl_shutdown_result; } +#endif static int dummy_handshake_func(SSL *s) @@ -1956,6 +1967,7 @@ test_tortls_shutdown(void *ignored) ret = tor_tls_shutdown(tls); tt_int_op(ret, OP_EQ, -9); +#ifndef LIBRESSL_VERSION_NUMBER tls->ssl->handshake_func = dummy_handshake_func; fixed_ssl_read_result_index = 0; @@ -2017,6 +2029,7 @@ test_tortls_shutdown(void *ignored) method->ssl_shutdown = setting_version_and_state_ssl_shutdown; ret = tor_tls_shutdown(tls); tt_int_op(ret, OP_EQ, TOR_TLS_ERROR_MISC); +#endif done: teardown_capture_of_logs(previous_log); @@ -2079,6 +2092,7 @@ test_tortls_read(void *ignored) ret = tor_tls_read(tls, buf, 10); tt_int_op(negotiated_callback_called, OP_EQ, 1); +#ifndef LIBRESSL_VERSION_NUMBER fixed_ssl_read_result_index = 0; fixed_ssl_read_result[0] = 0; tls->ssl->version = SSL2_VERSION; @@ -2086,7 +2100,7 @@ test_tortls_read(void *ignored) ret = tor_tls_read(tls, buf, 10); tt_int_op(ret, OP_EQ, TOR_TLS_CLOSE); tt_int_op(tls->state, OP_EQ, TOR_TLS_ST_CLOSED); - +#endif // TODO: fill up done:

1 0

[tor/master] Make crypto/rng_engine test pass on libressl. Bug not in any released tor.
by nickm＠torproject.org 03 Feb '16

03 Feb '16

commit c1c3e45eab08b3ce31254c749fe10d93c6b65cb9 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Feb 3 11:18:16 2016 -0500 Make crypto/rng_engine test pass on libressl. Bug not in any released tor. --- src/test/test_crypto.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/test/test_crypto.c b/src/test/test_crypto.c index 3244c21..671ae7d 100644 --- a/src/test/test_crypto.c +++ b/src/test/test_crypto.c @@ -147,8 +147,14 @@ test_crypto_rng_engine(void *arg) /* We should correct the method if it's a dummy. */ RAND_set_rand_method(&dummy_method); +#ifdef LIBRESSL_VERSION_NUMBER + /* On libressl, you can't override the RNG. */ + tt_assert(RAND_get_rand_method() == RAND_OpenSSL()); + tt_int_op(0, ==, crypto_force_rand_ssleay()); +#else tt_assert(RAND_get_rand_method() == &dummy_method); tt_int_op(1, ==, crypto_force_rand_ssleay()); +#endif tt_assert(RAND_get_rand_method() == RAND_OpenSSL()); /* Make sure we aren't calling dummy_method */

1 0

[tor/master] Merge branch 'openssl_compat'
by nickm＠torproject.org 03 Feb '16

03 Feb '16

commit a5f7a8b047e3e0e58604b054ef98b998be537523 Merge: 957cdb5 fa52b6f Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Feb 3 14:46:33 2016 -0500 Merge branch 'openssl_compat' changes/bug17921_bug17984 | 4 ++++ src/common/aes.c | 31 +++++++++++++++---------------- src/common/aes.h | 1 - src/common/compat_openssl.h | 2 ++ src/common/crypto.c | 4 ++++ src/common/tortls.c | 18 ++++++++++++------ src/common/tortls.h | 7 ++++--- src/test/test_crypto.c | 20 ++++++++++++++++---- src/test/test_tortls.c | 33 +++++++++++++++++++++++---------- 9 files changed, 80 insertions(+), 40 deletions(-)

1 0