November 2018 - tor-commits - lists.torproject.org

[tor/release-0.2.9] Merge branch 'bug28245_029' into maint-0.2.9
by nickm＠torproject.org 09 Nov '18

09 Nov '18

commit 45e0004b690b913dc991936ca0228a35fd5c7d1e Merge: 0a824bd88 1ba1a1cec Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Nov 9 10:49:43 2018 -0500 Merge branch 'bug28245_029' into maint-0.2.9 changes/bug28245 | 6 ++++++ configure.ac | 1 + src/common/tortls.c | 17 +++++++++++++++++ 3 files changed, 24 insertions(+)

1 0

[tor/release-0.2.9] Always declare groups when building with openssl 1.1.1 APIs
by nickm＠torproject.org 09 Nov '18

09 Nov '18

commit 1ba1a1ceca4501b673bfc56b15f1063ce35afe4e Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Nov 9 10:10:25 2018 -0500 Always declare groups when building with openssl 1.1.1 APIs Failing to do on clients was causing TLS 1.3 negotiation to fail. Fixes bug 28245; bugfix on 0.2.9.15, when we added TLS 1.3 support. --- changes/bug28245 | 6 ++++++ configure.ac | 1 + src/common/tortls.c | 17 +++++++++++++++++ 3 files changed, 24 insertions(+) diff --git a/changes/bug28245 b/changes/bug28245 new file mode 100644 index 000000000..d7e6deb81 --- /dev/null +++ b/changes/bug28245 @@ -0,0 +1,6 @@ + o Major bugfixes (OpenSSL, portability): + - Fix our usage of named groups when running as a TLS 1.3 client in + OpenSSL 1.1.1. Previously, we only initialized EC groups when running + as a server, which caused clients to fail to negotiate TLS 1.3 with + relays. Fixes bug 28245; bugfix on 0.2.9.15 when TLS 1.3 support was + added. diff --git a/configure.ac b/configure.ac index 772ae432a..771769422 100644 --- a/configure.ac +++ b/configure.ac @@ -677,6 +677,7 @@ AC_CHECK_FUNCS([ \ SSL_get_server_random \ SSL_get_client_ciphers \ SSL_get_client_random \ + SSL_CTX_set1_groups_list \ SSL_CIPHER_find \ SSL_CTX_set_security_level \ TLS_method diff --git a/src/common/tortls.c b/src/common/tortls.c index 1f2fe1ce1..7c50f8711 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -1217,6 +1217,22 @@ tor_tls_context_new(crypto_pk_t *identity, unsigned int key_lifetime, SSL_CTX_set_tmp_dh(result->ctx, crypto_dh_get_dh_(dh)); crypto_dh_free(dh); } +/* We check for this function in two ways, since it might be either a symbol + * or a macro. */ +#if defined(SSL_CTX_set1_groups_list) || defined(HAVE_SSL_CTX_SET1_GROUPS_LIST) + { + const char *list; + if (flags & TOR_TLS_CTX_USE_ECDHE_P224) + list = "P-224:P-256"; + else if (flags & TOR_TLS_CTX_USE_ECDHE_P256) + list = "P-256:P-224"; + else + list = "P-256:P-224"; + int r = SSL_CTX_set1_groups_list(result->ctx, list); + if (r < 0) + goto error; + } +#else if (! is_client) { int nid; EC_KEY *ec_key; @@ -1232,6 +1248,7 @@ tor_tls_context_new(crypto_pk_t *identity, unsigned int key_lifetime, SSL_CTX_set_tmp_ecdh(result->ctx, ec_key); EC_KEY_free(ec_key); } +#endif SSL_CTX_set_verify(result->ctx, SSL_VERIFY_PEER, always_accept_verify_cb); /* let us realloc bufs that we're writing from */

1 0

[tor/release-0.3.4] Merge branch 'bug28245_029' into maint-0.2.9
by nickm＠torproject.org 09 Nov '18

09 Nov '18

commit 45e0004b690b913dc991936ca0228a35fd5c7d1e Merge: 0a824bd88 1ba1a1cec Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Nov 9 10:49:43 2018 -0500 Merge branch 'bug28245_029' into maint-0.2.9 changes/bug28245 | 6 ++++++ configure.ac | 1 + src/common/tortls.c | 17 +++++++++++++++++ 3 files changed, 24 insertions(+)

1 0

[tor/release-0.3.3] Always declare groups when building with openssl 1.1.1 APIs
by nickm＠torproject.org 09 Nov '18

09 Nov '18

commit 1ba1a1ceca4501b673bfc56b15f1063ce35afe4e Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Nov 9 10:10:25 2018 -0500 Always declare groups when building with openssl 1.1.1 APIs Failing to do on clients was causing TLS 1.3 negotiation to fail. Fixes bug 28245; bugfix on 0.2.9.15, when we added TLS 1.3 support. --- changes/bug28245 | 6 ++++++ configure.ac | 1 + src/common/tortls.c | 17 +++++++++++++++++ 3 files changed, 24 insertions(+) diff --git a/changes/bug28245 b/changes/bug28245 new file mode 100644 index 000000000..d7e6deb81 --- /dev/null +++ b/changes/bug28245 @@ -0,0 +1,6 @@ + o Major bugfixes (OpenSSL, portability): + - Fix our usage of named groups when running as a TLS 1.3 client in + OpenSSL 1.1.1. Previously, we only initialized EC groups when running + as a server, which caused clients to fail to negotiate TLS 1.3 with + relays. Fixes bug 28245; bugfix on 0.2.9.15 when TLS 1.3 support was + added. diff --git a/configure.ac b/configure.ac index 772ae432a..771769422 100644 --- a/configure.ac +++ b/configure.ac @@ -677,6 +677,7 @@ AC_CHECK_FUNCS([ \ SSL_get_server_random \ SSL_get_client_ciphers \ SSL_get_client_random \ + SSL_CTX_set1_groups_list \ SSL_CIPHER_find \ SSL_CTX_set_security_level \ TLS_method diff --git a/src/common/tortls.c b/src/common/tortls.c index 1f2fe1ce1..7c50f8711 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -1217,6 +1217,22 @@ tor_tls_context_new(crypto_pk_t *identity, unsigned int key_lifetime, SSL_CTX_set_tmp_dh(result->ctx, crypto_dh_get_dh_(dh)); crypto_dh_free(dh); } +/* We check for this function in two ways, since it might be either a symbol + * or a macro. */ +#if defined(SSL_CTX_set1_groups_list) || defined(HAVE_SSL_CTX_SET1_GROUPS_LIST) + { + const char *list; + if (flags & TOR_TLS_CTX_USE_ECDHE_P224) + list = "P-224:P-256"; + else if (flags & TOR_TLS_CTX_USE_ECDHE_P256) + list = "P-256:P-224"; + else + list = "P-256:P-224"; + int r = SSL_CTX_set1_groups_list(result->ctx, list); + if (r < 0) + goto error; + } +#else if (! is_client) { int nid; EC_KEY *ec_key; @@ -1232,6 +1248,7 @@ tor_tls_context_new(crypto_pk_t *identity, unsigned int key_lifetime, SSL_CTX_set_tmp_ecdh(result->ctx, ec_key); EC_KEY_free(ec_key); } +#endif SSL_CTX_set_verify(result->ctx, SSL_VERIFY_PEER, always_accept_verify_cb); /* let us realloc bufs that we're writing from */

1 0

[tor/release-0.3.3] Merge branch 'maint-0.2.9' into maint-0.3.3
by nickm＠torproject.org 09 Nov '18

09 Nov '18

commit c06b7f090cfe49cef1b174d69277534eb0441696 Merge: 6bd069630 45e0004b6 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Nov 9 10:49:47 2018 -0500 Merge branch 'maint-0.2.9' into maint-0.3.3 changes/bug28245 | 6 ++++++ configure.ac | 1 + src/common/tortls.c | 17 +++++++++++++++++ 3 files changed, 24 insertions(+)

1 0

[tor/release-0.3.3] Merge branch 'maint-0.3.3' into release-0.3.3
by nickm＠torproject.org 09 Nov '18

09 Nov '18

commit 93cf98cbb160f31804d129e6e3e33355883fc1b2 Merge: dd0b85179 c06b7f090 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Nov 9 10:49:47 2018 -0500 Merge branch 'maint-0.3.3' into release-0.3.3 changes/bug28245 | 6 ++++++ configure.ac | 1 + src/common/tortls.c | 17 +++++++++++++++++ 3 files changed, 24 insertions(+)

1 0

[tor/release-0.3.4] Merge branch 'maint-0.2.9' into maint-0.3.3
by nickm＠torproject.org 09 Nov '18

09 Nov '18

commit c06b7f090cfe49cef1b174d69277534eb0441696 Merge: 6bd069630 45e0004b6 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Nov 9 10:49:47 2018 -0500 Merge branch 'maint-0.2.9' into maint-0.3.3 changes/bug28245 | 6 ++++++ configure.ac | 1 + src/common/tortls.c | 17 +++++++++++++++++ 3 files changed, 24 insertions(+)

1 0

[tor/release-0.3.4] Always declare groups when building with openssl 1.1.1 APIs
by nickm＠torproject.org 09 Nov '18

09 Nov '18

commit 1ba1a1ceca4501b673bfc56b15f1063ce35afe4e Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Nov 9 10:10:25 2018 -0500 Always declare groups when building with openssl 1.1.1 APIs Failing to do on clients was causing TLS 1.3 negotiation to fail. Fixes bug 28245; bugfix on 0.2.9.15, when we added TLS 1.3 support. --- changes/bug28245 | 6 ++++++ configure.ac | 1 + src/common/tortls.c | 17 +++++++++++++++++ 3 files changed, 24 insertions(+) diff --git a/changes/bug28245 b/changes/bug28245 new file mode 100644 index 000000000..d7e6deb81 --- /dev/null +++ b/changes/bug28245 @@ -0,0 +1,6 @@ + o Major bugfixes (OpenSSL, portability): + - Fix our usage of named groups when running as a TLS 1.3 client in + OpenSSL 1.1.1. Previously, we only initialized EC groups when running + as a server, which caused clients to fail to negotiate TLS 1.3 with + relays. Fixes bug 28245; bugfix on 0.2.9.15 when TLS 1.3 support was + added. diff --git a/configure.ac b/configure.ac index 772ae432a..771769422 100644 --- a/configure.ac +++ b/configure.ac @@ -677,6 +677,7 @@ AC_CHECK_FUNCS([ \ SSL_get_server_random \ SSL_get_client_ciphers \ SSL_get_client_random \ + SSL_CTX_set1_groups_list \ SSL_CIPHER_find \ SSL_CTX_set_security_level \ TLS_method diff --git a/src/common/tortls.c b/src/common/tortls.c index 1f2fe1ce1..7c50f8711 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -1217,6 +1217,22 @@ tor_tls_context_new(crypto_pk_t *identity, unsigned int key_lifetime, SSL_CTX_set_tmp_dh(result->ctx, crypto_dh_get_dh_(dh)); crypto_dh_free(dh); } +/* We check for this function in two ways, since it might be either a symbol + * or a macro. */ +#if defined(SSL_CTX_set1_groups_list) || defined(HAVE_SSL_CTX_SET1_GROUPS_LIST) + { + const char *list; + if (flags & TOR_TLS_CTX_USE_ECDHE_P224) + list = "P-224:P-256"; + else if (flags & TOR_TLS_CTX_USE_ECDHE_P256) + list = "P-256:P-224"; + else + list = "P-256:P-224"; + int r = SSL_CTX_set1_groups_list(result->ctx, list); + if (r < 0) + goto error; + } +#else if (! is_client) { int nid; EC_KEY *ec_key; @@ -1232,6 +1248,7 @@ tor_tls_context_new(crypto_pk_t *identity, unsigned int key_lifetime, SSL_CTX_set_tmp_ecdh(result->ctx, ec_key); EC_KEY_free(ec_key); } +#endif SSL_CTX_set_verify(result->ctx, SSL_VERIFY_PEER, always_accept_verify_cb); /* let us realloc bufs that we're writing from */

1 0

[tor/release-0.3.4] Merge branch 'maint-0.3.3' into maint-0.3.4
by nickm＠torproject.org 09 Nov '18

09 Nov '18

commit 591a189fa42c87d706b4395ac6e70110f88b4fe9 Merge: 5acf6f871 c06b7f090 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Nov 9 10:49:47 2018 -0500 Merge branch 'maint-0.3.3' into maint-0.3.4 changes/bug28245 | 6 ++++++ configure.ac | 1 + src/common/tortls.c | 17 +++++++++++++++++ 3 files changed, 24 insertions(+)

1 0

[tor/release-0.3.5] Merge branch 'maint-0.2.9' into maint-0.3.3
by nickm＠torproject.org 09 Nov '18

09 Nov '18

commit c06b7f090cfe49cef1b174d69277534eb0441696 Merge: 6bd069630 45e0004b6 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Nov 9 10:49:47 2018 -0500 Merge branch 'maint-0.2.9' into maint-0.3.3 changes/bug28245 | 6 ++++++ configure.ac | 1 + src/common/tortls.c | 17 +++++++++++++++++ 3 files changed, 24 insertions(+)

1 0