February 2017 - tor-commits - lists.torproject.org

[tor/maint-0.2.9] Support LibreSSL with opaque structures
by nickm＠torproject.org 01 Feb '17

01 Feb '17

commit e9ec818c28c96ba1ca6f40c9ccc84c900a5b7265 Author: rubiate <cb(a)viennan.net> Date: Thu Feb 2 00:10:46 2017 +1300 Support LibreSSL with opaque structures Determining if OpenSSL structures are opaque now uses an autoconf check instead of comparing the version number. Some definitions have been moved to their own check as assumptions which were true for OpenSSL with opaque structures did not hold for LibreSSL. Closes ticket 21359. --- changes/21359 | 8 ++++++++ configure.ac | 5 +++++ src/test/test_tortls.c | 43 ++++++++++++++++++++++++------------------- 3 files changed, 37 insertions(+), 19 deletions(-) diff --git a/changes/21359 b/changes/21359 new file mode 100644 index 0000000..3b54c91 --- /dev/null +++ b/changes/21359 @@ -0,0 +1,8 @@ + o Testing + - tortls tests now use an autoconf check to determine if OpenSSL + structures are opaque, instead of an explicit version check. + See ticket 21359. + + o Minor bugfixes (compilation) + - Support building with recent LibreSSL code that uses opaque + structures. Closes ticket 21359. diff --git a/configure.ac b/configure.ac index 2134a41..f7bdd97 100644 --- a/configure.ac +++ b/configure.ac @@ -677,6 +677,11 @@ AC_CHECK_FUNCS([ \ dnl Check if OpenSSL has scrypt implementation. AC_CHECK_FUNCS([ EVP_PBE_scrypt ]) +dnl Check if OpenSSL structures are opaque +AC_CHECK_MEMBERS([SSL.state], , , +[#include <openssl/ssl.h> +]) + LIBS="$save_LIBS" LDFLAGS="$save_LDFLAGS" CPPFLAGS="$save_CPPFLAGS" diff --git a/src/test/test_tortls.c b/src/test/test_tortls.c index 1cba617..47455cf 100644 --- a/src/test/test_tortls.c +++ b/src/test/test_tortls.c @@ -38,9 +38,11 @@ ENABLE_GCC_WARNING(redundant-decls) #include "log_test_helpers.h" #define NS_MODULE tortls -#if OPENSSL_VERSION_NUMBER >= OPENSSL_V_SERIES(1,1,0) \ - && !defined(LIBRESSL_VERSION_NUMBER) +#ifndef HAVE_SSL_STATE #define OPENSSL_OPAQUE +#endif + +#if defined(OPENSSL_OPAQUE) && !defined(LIBRESSL_VERSION_NUMBER) #define SSL_STATE_STR "before SSL initialization" #else #define SSL_STATE_STR "before/accept initialization" @@ -723,6 +725,26 @@ test_tortls_get_my_certs(void *ignored) (void)1; } +#ifndef HAVE_SSL_GET_CLIENT_CIPHERS +static SSL_CIPHER * +get_cipher_by_name(const char *name) +{ + int i; + const SSL_METHOD *method = SSLv23_method(); + int num = method->num_ciphers(); + + for (i = 0; i < num; ++i) { + const SSL_CIPHER *cipher = method->get_cipher(i); + const char *ciphername = SSL_CIPHER_get_name(cipher); + if (!strcmp(ciphername, name)) { + return (SSL_CIPHER *)cipher; + } + } + + return NULL; +} +#endif + #ifndef OPENSSL_OPAQUE static void test_tortls_get_ciphersuite_name(void *ignored) @@ -742,23 +764,6 @@ test_tortls_get_ciphersuite_name(void *ignored) } static SSL_CIPHER * -get_cipher_by_name(const char *name) -{ - int i; - const SSL_METHOD *method = SSLv23_method(); - int num = method->num_ciphers(); - for (i = 0; i < num; ++i) { - const SSL_CIPHER *cipher = method->get_cipher(i); - const char *ciphername = SSL_CIPHER_get_name(cipher); - if (!strcmp(ciphername, name)) { - return (SSL_CIPHER *)cipher; - } - } - - return NULL; -} - -static SSL_CIPHER * get_cipher_by_id(uint16_t id) { int i;

1 0

[tor/maint-0.2.9] Rework 21359 changes file slightly.
by nickm＠torproject.org 01 Feb '17

01 Feb '17

commit b928095afc757ab8616642b48e3f22a0b39520b9 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Feb 1 10:39:48 2017 -0500 Rework 21359 changes file slightly. --- changes/21359 | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/changes/21359 b/changes/21359 index 3b54c91..cc9b377 100644 --- a/changes/21359 +++ b/changes/21359 @@ -1,8 +1,8 @@ - o Testing - - tortls tests now use an autoconf check to determine if OpenSSL - structures are opaque, instead of an explicit version check. - See ticket 21359. - o Minor bugfixes (compilation) + o Minor features (portability, compilationc) - Support building with recent LibreSSL code that uses opaque structures. Closes ticket 21359. + - Autoconf now check to determine if OpenSSL + structures are opaque, instead of explicitly checking for + OpenSSL version numbers. + Part of ticket 21359.

1 0

[tor/master] Rework 21359 changes file slightly.
by nickm＠torproject.org 01 Feb '17

01 Feb '17

commit b928095afc757ab8616642b48e3f22a0b39520b9 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Feb 1 10:39:48 2017 -0500 Rework 21359 changes file slightly. --- changes/21359 | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/changes/21359 b/changes/21359 index 3b54c91..cc9b377 100644 --- a/changes/21359 +++ b/changes/21359 @@ -1,8 +1,8 @@ - o Testing - - tortls tests now use an autoconf check to determine if OpenSSL - structures are opaque, instead of an explicit version check. - See ticket 21359. - o Minor bugfixes (compilation) + o Minor features (portability, compilationc) - Support building with recent LibreSSL code that uses opaque structures. Closes ticket 21359. + - Autoconf now check to determine if OpenSSL + structures are opaque, instead of explicitly checking for + OpenSSL version numbers. + Part of ticket 21359.

1 0

[tor/release-0.2.9] Rework 21359 changes file slightly.
by nickm＠torproject.org 01 Feb '17

01 Feb '17

commit b928095afc757ab8616642b48e3f22a0b39520b9 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Feb 1 10:39:48 2017 -0500 Rework 21359 changes file slightly. --- changes/21359 | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/changes/21359 b/changes/21359 index 3b54c91..cc9b377 100644 --- a/changes/21359 +++ b/changes/21359 @@ -1,8 +1,8 @@ - o Testing - - tortls tests now use an autoconf check to determine if OpenSSL - structures are opaque, instead of an explicit version check. - See ticket 21359. - o Minor bugfixes (compilation) + o Minor features (portability, compilationc) - Support building with recent LibreSSL code that uses opaque structures. Closes ticket 21359. + - Autoconf now check to determine if OpenSSL + structures are opaque, instead of explicitly checking for + OpenSSL version numbers. + Part of ticket 21359.

1 0

[tor/release-0.2.9] Merge branch 'maint-0.2.9' into release-0.2.9
by nickm＠torproject.org 01 Feb '17

01 Feb '17

commit 5cdc7a40ab61181fdb14f11d71b1e6e066f4a7b3 Merge: c1d23c6 b928095 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Feb 1 10:39:54 2017 -0500 Merge branch 'maint-0.2.9' into release-0.2.9 changes/21359 | 8 ++++++++ configure.ac | 5 +++++ src/test/test_tortls.c | 43 ++++++++++++++++++++++++------------------- 3 files changed, 37 insertions(+), 19 deletions(-)

1 0

[tor/master] Fix write_short_policy usage comment
by nickm＠torproject.org 01 Feb '17

01 Feb '17

commit e95b8f7df9faf61dea8f523da7548a7217aa831a Author: teor <teor2345(a)gmail.com> Date: Wed Feb 1 13:48:09 2017 +1100 Fix write_short_policy usage comment --- src/or/policies.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/or/policies.c b/src/or/policies.c index 227e168..1262bef 100644 --- a/src/or/policies.c +++ b/src/or/policies.c @@ -2624,8 +2624,7 @@ parse_short_policy(const char *summary) return result; } -/** Write <b>policy</b> back out into a string. Used only for unit tests - * currently. */ +/** Write <b>policy</b> back out into a string. */ char * write_short_policy(const short_policy_t *policy) {

1 0

[tor/master] Scale IPv6 address counts in policy_summary_reject to avoid overflow
by nickm＠torproject.org 01 Feb '17

01 Feb '17

commit 408c53b7a78767e04124fec4c4d470fe474e4906 Author: teor <teor2345(a)gmail.com> Date: Wed Feb 1 15:31:33 2017 +1100 Scale IPv6 address counts in policy_summary_reject to avoid overflow This disregards anything smaller than an IPv6 /64, and rejects ports that are rejected on an IPv6 /16 or larger. Adjust existing unit tests, and add more to cover exceptional cases. No IPv4 behaviour changes. Fixes bug 21357 --- src/or/policies.c | 35 +++++++++++++++++++++++++++++------ src/test/test_policy.c | 42 ++++++++++++++++++++++++++++++++++++++++-- 2 files changed, 69 insertions(+), 8 deletions(-) diff --git a/src/or/policies.c b/src/or/policies.c index cac475d..6037ee3 100644 --- a/src/or/policies.c +++ b/src/or/policies.c @@ -2300,15 +2300,24 @@ policy_summary_item_split(policy_summary_item_t* old, uint16_t new_starts) #define AT(x) ((policy_summary_item_t*)smartlist_get(summary, x)) #define IPV4_BITS (32) +/* Every IPv4 address is counted as one rejection */ +#define REJECT_CUTOFF_SCALE_IPV4 (0) /* Ports are rejected in an IPv4 summary if they are rejected in more than two * IPv4 /8 address blocks */ #define REJECT_CUTOFF_COUNT_IPV4 (U64_LITERAL(1) << \ - (IPV4_BITS - 7)) + (IPV4_BITS - REJECT_CUTOFF_SCALE_IPV4 - 7)) #define IPV6_BITS (128) -/* Ports are rejected in an IPv6 summary if they are rejected in at least one - * IPv6 /64. */ -#define REJECT_CUTOFF_COUNT_IPV6 (UINT64_MAX) +/* IPv6 /64s are counted as one rejection, anything smaller is ignored */ +#define REJECT_CUTOFF_SCALE_IPV6 (64) +/* Ports are rejected in an IPv6 summary if they are rejected in more than one + * IPv6 /16 address block. + * This is rougly equivalent to the IPv4 cutoff, as only five IPv6 /12s (and + * some scattered smaller blocks) have been allocated to the RIRs. + * Network providers are typically allocated one or more IPv6 /32s. + */ +#define REJECT_CUTOFF_COUNT_IPV6 (U64_LITERAL(1) << \ + (IPV6_BITS - REJECT_CUTOFF_SCALE_IPV6 - 16)) /** Split an exit policy summary so that prt_min and prt_max * fall at exactly the start and end of an item respectively. @@ -2381,14 +2390,28 @@ policy_summary_reject(smartlist_t *summary, int addrbits = (family == AF_INET) ? IPV4_BITS : IPV6_BITS; tor_assert_nonfatal_once(addrbits >= maskbits); + /* We divide IPv6 address counts by (1 << scale) to keep them in a uint64_t + */ + int scale = ((family == AF_INET) ? + REJECT_CUTOFF_SCALE_IPV4 : + REJECT_CUTOFF_SCALE_IPV6); + + tor_assert_nonfatal_once(addrbits >= scale); + if (maskbits > (addrbits - scale)) { + tor_assert_nonfatal_once(family == AF_INET6); + /* The address range is so small, we'd need billions of them to reach the + * rejection limit. So we ignore this range in the reject count. */ + return; + } + uint64_t count = 0; - if (addrbits - maskbits >= 64) { + if (addrbits - scale - maskbits >= 64) { tor_assert_nonfatal_once(family == AF_INET6); /* The address range is so large, it's an automatic rejection for all ports * in the range. */ count = UINT64_MAX; } else { - count = (U64_LITERAL(1) << (addrbits - maskbits)); + count = (U64_LITERAL(1) << (addrbits - scale - maskbits)); } tor_assert_nonfatal_once(count > 0); while (i < smartlist_len(summary) && diff --git a/src/test/test_policy.c b/src/test/test_policy.c index fb7195a..f2d42b9 100644 --- a/src/test/test_policy.c +++ b/src/test/test_policy.c @@ -594,13 +594,51 @@ test_policies_general(void *arg) /* short policy with configured netblocks */ test_policy_summary_helper("reject 149.56.0.0/16," "reject6 2607:5300::/32," + "reject6 2608:5300::/64," + "reject6 2609:5300::/96," + "accept *:80," + "accept *:443," + "reject *:*", + "accept 80,443"); + /* short policy with large netblocks that do not count as a rejection */ + test_policy_summary_helper("reject 148.0.0.0/7," + "reject6 2600::/16," "accept *:80," "accept *:443," "reject *:*", "accept 80,443"); /* short policy with large netblocks that count as a rejection */ - test_policy_summary_helper("reject 149.0.0.0/6," - "reject6 2600::/6," + test_policy_summary_helper("reject 148.0.0.0/6," + "reject6 2600::/15," + "accept *:80," + "accept *:443," + "reject *:*", + "reject 1-65535"); + /* short policy with huge netblocks that count as a rejection */ + test_policy_summary_helper("reject 128.0.0.0/1," + "reject6 8000::/1," + "accept *:80," + "accept *:443," + "reject *:*", + "reject 1-65535"); + /* short policy which blocks everything using netblocks */ + test_policy_summary_helper("reject 0.0.0.0/0," + "reject6 ::/0," + "accept *:80," + "accept *:443," + "reject *:*", + "reject 1-65535"); + /* short policy which has repeated redundant netblocks */ + test_policy_summary_helper("reject 0.0.0.0/0," + "reject 0.0.0.0/0," + "reject 0.0.0.0/0," + "reject 0.0.0.0/0," + "reject 0.0.0.0/0," + "reject6 ::/0," + "reject6 ::/0," + "reject6 ::/0," + "reject6 ::/0," + "reject6 ::/0," "accept *:80," "accept *:443," "reject *:*",

1 0

[tor/master] Fix IPv6 support in policy_summary_reject and policy_summary_accept
by nickm＠torproject.org 01 Feb '17

01 Feb '17

commit 4667a40ca944134866b95b10407a7e471206aa00 Author: teor <teor2345(a)gmail.com> Date: Wed Feb 1 15:28:46 2017 +1100 Fix IPv6 support in policy_summary_reject and policy_summary_accept This interim fix results in too many IPv6 rejections. No behaviour change for IPv4 counts, except for overflow fixes that would require 4 billion redundant 0.0.0.0/0 policy entries to trigger. Part of 21357 --- src/or/policies.c | 60 +++++++++++++++++++++++++++++++++++++++++++------------ 1 file changed, 47 insertions(+), 13 deletions(-) diff --git a/src/or/policies.c b/src/or/policies.c index 71062eb..cac475d 100644 --- a/src/or/policies.c +++ b/src/or/policies.c @@ -2304,6 +2304,12 @@ policy_summary_item_split(policy_summary_item_t* old, uint16_t new_starts) * IPv4 /8 address blocks */ #define REJECT_CUTOFF_COUNT_IPV4 (U64_LITERAL(1) << \ (IPV4_BITS - 7)) + +#define IPV6_BITS (128) +/* Ports are rejected in an IPv6 summary if they are rejected in at least one + * IPv6 /64. */ +#define REJECT_CUTOFF_COUNT_IPV6 (UINT64_MAX) + /** Split an exit policy summary so that prt_min and prt_max * fall at exactly the start and end of an item respectively. */ @@ -2336,40 +2342,68 @@ policy_summary_split(smartlist_t *summary, return start_at_index; } -/** Mark port ranges as accepted if they are below the reject_count */ +/** Mark port ranges as accepted if they are below the reject_count for family + */ static void policy_summary_accept(smartlist_t *summary, - uint16_t prt_min, uint16_t prt_max) + uint16_t prt_min, uint16_t prt_max, + sa_family_t family) { + tor_assert_nonfatal_once(family == AF_INET || family == AF_INET6); + uint64_t family_reject_count = ((family == AF_INET) ? + REJECT_CUTOFF_COUNT_IPV4 : + REJECT_CUTOFF_COUNT_IPV6); + int i = policy_summary_split(summary, prt_min, prt_max); while (i < smartlist_len(summary) && AT(i)->prt_max <= prt_max) { if (!AT(i)->accepted && - AT(i)->reject_count <= REJECT_CUTOFF_COUNT_IPV4) + AT(i)->reject_count <= family_reject_count) AT(i)->accepted = 1; i++; } tor_assert(i < smartlist_len(summary) || prt_max==65535); } -/** Count the number of addresses in a network with prefixlen maskbits - * against the given portrange. */ +/** Count the number of addresses in a network in family with prefixlen + * maskbits against the given portrange. */ static void policy_summary_reject(smartlist_t *summary, maskbits_t maskbits, - uint16_t prt_min, uint16_t prt_max) + uint16_t prt_min, uint16_t prt_max, + sa_family_t family) { + tor_assert_nonfatal_once(family == AF_INET || family == AF_INET6); + int i = policy_summary_split(summary, prt_min, prt_max); - /* XXX: ipv4 specific */ + /* The length of a single address mask */ - int addrbits = IPV4_BITS; + int addrbits = (family == AF_INET) ? IPV4_BITS : IPV6_BITS; tor_assert_nonfatal_once(addrbits >= maskbits); - uint64_t count = (U64_LITERAL(1) << (addrbits-maskbits)); + uint64_t count = 0; + if (addrbits - maskbits >= 64) { + tor_assert_nonfatal_once(family == AF_INET6); + /* The address range is so large, it's an automatic rejection for all ports + * in the range. */ + count = UINT64_MAX; + } else { + count = (U64_LITERAL(1) << (addrbits - maskbits)); + } tor_assert_nonfatal_once(count > 0); while (i < smartlist_len(summary) && AT(i)->prt_max <= prt_max) { - AT(i)->reject_count += count; + if (AT(i)->reject_count <= UINT64_MAX - count) { + AT(i)->reject_count += count; + } else { + /* IPv4 would require a 4-billion address redundant policy to get here, + * but IPv6 just needs to have ::/0 */ + if (family == AF_INET) { + tor_assert_nonfatal_unreached_once(); + } + /* If we do get here, use saturating arithmetic */ + AT(i)->reject_count = UINT64_MAX; + } i++; } tor_assert(i < smartlist_len(summary) || prt_max==65535); @@ -2389,7 +2423,7 @@ policy_summary_add_item(smartlist_t *summary, addr_policy_t *p) { if (p->policy_type == ADDR_POLICY_ACCEPT) { if (p->maskbits == 0) { - policy_summary_accept(summary, p->prt_min, p->prt_max); + policy_summary_accept(summary, p->prt_min, p->prt_max, p->addr.family); } } else if (p->policy_type == ADDR_POLICY_REJECT) { @@ -2410,7 +2444,8 @@ policy_summary_add_item(smartlist_t *summary, addr_policy_t *p) } if (!is_private) { - policy_summary_reject(summary, p->maskbits, p->prt_min, p->prt_max); + policy_summary_reject(summary, p->maskbits, p->prt_min, p->prt_max, + p->addr.family); } } else tor_assert(0); @@ -2444,7 +2479,6 @@ policy_summarize(smartlist_t *policy, sa_family_t family) } if (f != family) continue; - /* XXXX-ipv6 More family work is needed */ policy_summary_add_item(summary, p); } SMARTLIST_FOREACH_END(p);

1 0

[tor/master] Changes file for 21357: Stop rejecting all IPv6 traffic on some Exits
by nickm＠torproject.org 01 Feb '17

01 Feb '17

commit bed94a9ed9974d7ecd93078604baed14e548d531 Author: teor <teor2345(a)gmail.com> Date: Wed Feb 1 16:39:21 2017 +1100 Changes file for 21357: Stop rejecting all IPv6 traffic on some Exits This issue was triggered by 17027 in 0.2.8.1-alpha, which rejects a relay's own IPv6 address. Bugfix on commit 004f3f4e53 in 0.2.4.7-alpha. --- changes/bug21357 | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/changes/bug21357 b/changes/bug21357 new file mode 100644 index 0000000..a1cb43a --- /dev/null +++ b/changes/bug21357 @@ -0,0 +1,7 @@ + o Major bugfixes (IPv6 Exits): + - Stop rejecting all IPv6 traffic on Exits whose exit policy rejects IPv6 + addresses. Instead, only reject a port over IPv6 if the exit policy + rejects that port on more than an IPv6 /16 of addresses. This bug was + made worse by 17027 in 0.2.8.1-alpha, which rejects a relay's own IPv6 + address by default. + Fixes bug 21357; bugfix on commit 004f3f4e53 in 0.2.4.7-alpha.

1 0

[tor/master] Merge branch 'teor_bug21357-v2_029'
by nickm＠torproject.org 01 Feb '17

01 Feb '17

commit f1530d0e5a66f61c1d9f287cf0ae79f377b7d026 Merge: c3b6354 bed94a9 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Feb 1 09:39:25 2017 -0500 Merge branch 'teor_bug21357-v2_029' changes/bug21357 | 7 + src/or/policies.c | 95 +++++++-- src/or/policies.h | 3 + src/test/test_policy.c | 534 +++++++++++++++++++++++++++++++++++++++++++++++-- 4 files changed, 609 insertions(+), 30 deletions(-)

1 0