February 2018 - tor-commits - lists.torproject.org

[tor/release-0.3.2] Merge branch 'maint-0.3.2' into release-0.3.2
by nickm＠torproject.org 10 Feb '18

10 Feb '18

commit cb3c1f2e541c89789faa811be0a43b3288a4594c Merge: 67127dca5 4de20d175 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sat Feb 10 16:09:01 2018 -0500 Merge branch 'maint-0.3.2' into release-0.3.2 changes/bug24978 | 7 +++++++ src/common/ciphers.inc | 21 ++++++++++++++++++++- src/common/tortls.c | 28 +++++++++++++++++++++++++--- 3 files changed, 52 insertions(+), 4 deletions(-)

1 0

[tor/maint-0.3.1] Make Tor support TLS1.3 ciphers with OpenSSL 1.1.1
by nickm＠torproject.org 10 Feb '18

10 Feb '18

commit 0dbe3ddc334d5e343c2a926e972cc20cb131a42a Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jan 23 09:23:21 2018 -0500 Make Tor support TLS1.3 ciphers with OpenSSL 1.1.1 Without this patch, not only will TLS1.3 not work with Tor, but OpenSSL 1.1.1 with TLS1.3 enabled won't build any connections at all: It requires that either TLS1.3 be disabled, or some TLS1.3 ciphersuites be listed. Closes ticket 24978. --- changes/bug24978 | 7 +++++++ src/common/ciphers.inc | 21 ++++++++++++++++++++- src/common/tortls.c | 28 +++++++++++++++++++++++++--- 3 files changed, 52 insertions(+), 4 deletions(-) diff --git a/changes/bug24978 b/changes/bug24978 new file mode 100644 index 000000000..5dc45c744 --- /dev/null +++ b/changes/bug24978 @@ -0,0 +1,7 @@ + o Minor features (compatibility, OpenSSL): + - Tor will now support TLS1.3 once OpenSSL 1.1.1 is released. + Previous versions of Tor would not have worked with OpenSSL + 1.1.1, since they neither disabled TLS 1.3 nor enabled any of the + ciphersuites it requires. Here we enable the TLS 1.3 ciphersuites. + Closes ticket 24978. + diff --git a/src/common/ciphers.inc b/src/common/ciphers.inc index ab4ac4072..23f5fd2da 100644 --- a/src/common/ciphers.inc +++ b/src/common/ciphers.inc @@ -2,8 +2,27 @@ * advertise. Before including it, you should define the CIPHER and XCIPHER * macros. * - * This file was automatically generated by get_mozilla_ciphers.py. + * This file was automatically generated by get_mozilla_ciphers.py; + * TLSv1.3 ciphers were added manually. */ + +/* Here are the TLS1.3 ciphers. Note that we don't have XCIPHER instances + * here, since we don't want to ever fake them. + */ +#ifdef TLS1_3_TXT_AES_128_GCM_SHA256 + CIPHER(0x1301, TLS1_3_TXT_AES_128_GCM_SHA256) +#endif +#ifdef TLS1_3_TXT_AES_256_GCM_SHA384 + CIPHER(0x1302, TLS1_3_TXT_AES_256_GCM_SHA384) +#endif +#ifdef TLS1_3_TXT_CHACHA20_POLY1305_SHA256 + CIPHER(0x1303, TLS1_3_TXT_CHACHA20_POLY1305_SHA256) +#endif +#ifdef TLS1_3_TXT_AES_128_CCM_SHA256 + CIPHER(0x1304, TLS1_3_TXT_AES_128_CCM_SHA256) +#endif + +/* Here's the machine-generated list. */ #ifdef TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 CIPHER(0xc02b, TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256) #else diff --git a/src/common/tortls.c b/src/common/tortls.c index d61cc2e58..a4e188603 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -550,13 +550,35 @@ MOCK_IMPL(STATIC X509 *, /** List of ciphers that servers should select from when the client might be * claiming extra unsupported ciphers in order to avoid fingerprinting. */ -#define SERVER_CIPHER_LIST \ - (TLS1_TXT_DHE_RSA_WITH_AES_256_SHA ":" \ - TLS1_TXT_DHE_RSA_WITH_AES_128_SHA) +static const char SERVER_CIPHER_LIST[] = +#ifdef TLS1_3_TXT_AES_128_GCM_SHA256 + /* This one can never actually get selected, since if the client lists it, + * we will assume that the client is honest, and not use this list. + * Nonetheless we list it if it's available, so that the server doesn't + * conclude that it has no valid ciphers if it's running with TLS1.3. + */ + TLS1_3_TXT_AES_128_GCM_SHA256 ":" +#endif + TLS1_TXT_DHE_RSA_WITH_AES_256_SHA ":" + TLS1_TXT_DHE_RSA_WITH_AES_128_SHA; /** List of ciphers that servers should select from when we actually have * our choice of what cipher to use. */ static const char UNRESTRICTED_SERVER_CIPHER_LIST[] = + /* Here are the TLS 1.3 ciphers we like, in the order we prefer. */ +#ifdef TLS1_3_TXT_AES_256_GCM_SHA384 + TLS1_3_TXT_AES_256_GCM_SHA384 ":" +#endif +#ifdef TLS1_3_TXT_CHACHA20_POLY1305_SHA256 + TLS1_3_TXT_CHACHA20_POLY1305_SHA256 ":" +#endif +#ifdef TLS1_3_TXT_AES_128_GCM_SHA256 + TLS1_3_TXT_AES_128_GCM_SHA256 ":" +#endif +#ifdef TLS1_3_TXT_AES_128_CCM_SHA256 + TLS1_3_TXT_AES_128_CCM_SHA256 ":" +#endif + /* This list is autogenerated with the gen_server_ciphers.py script; * don't hand-edit it. */ #ifdef TLS1_TXT_ECDHE_RSA_WITH_AES_256_GCM_SHA384

1 0

[tor/maint-0.3.1] Merge branch 'bug24978_029_enable' into maint-0.2.9
by nickm＠torproject.org 10 Feb '18

10 Feb '18

commit 320dac4602dd26bc64f1f0fd1cff5d7b38bb09eb Merge: 0ddc2dc53 0dbe3ddc3 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sat Feb 10 16:08:58 2018 -0500 Merge branch 'bug24978_029_enable' into maint-0.2.9 changes/bug24978 | 7 +++++++ src/common/ciphers.inc | 21 ++++++++++++++++++++- src/common/tortls.c | 28 +++++++++++++++++++++++++--- 3 files changed, 52 insertions(+), 4 deletions(-)

1 0

[tor/maint-0.3.1] Merge branch 'maint-0.2.9' into maint-0.3.1
by nickm＠torproject.org 10 Feb '18

10 Feb '18

commit 86583ad78e6c75ea0094553584428f795089c482 Merge: 04a8e81fa 320dac460 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sat Feb 10 16:09:00 2018 -0500 Merge branch 'maint-0.2.9' into maint-0.3.1 changes/bug24978 | 7 +++++++ src/common/ciphers.inc | 21 ++++++++++++++++++++- src/common/tortls.c | 28 +++++++++++++++++++++++++--- 3 files changed, 52 insertions(+), 4 deletions(-)

1 0

[tor/maint-0.2.9] Make Tor support TLS1.3 ciphers with OpenSSL 1.1.1
by nickm＠torproject.org 10 Feb '18

10 Feb '18

commit 0dbe3ddc334d5e343c2a926e972cc20cb131a42a Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jan 23 09:23:21 2018 -0500 Make Tor support TLS1.3 ciphers with OpenSSL 1.1.1 Without this patch, not only will TLS1.3 not work with Tor, but OpenSSL 1.1.1 with TLS1.3 enabled won't build any connections at all: It requires that either TLS1.3 be disabled, or some TLS1.3 ciphersuites be listed. Closes ticket 24978. --- changes/bug24978 | 7 +++++++ src/common/ciphers.inc | 21 ++++++++++++++++++++- src/common/tortls.c | 28 +++++++++++++++++++++++++--- 3 files changed, 52 insertions(+), 4 deletions(-) diff --git a/changes/bug24978 b/changes/bug24978 new file mode 100644 index 000000000..5dc45c744 --- /dev/null +++ b/changes/bug24978 @@ -0,0 +1,7 @@ + o Minor features (compatibility, OpenSSL): + - Tor will now support TLS1.3 once OpenSSL 1.1.1 is released. + Previous versions of Tor would not have worked with OpenSSL + 1.1.1, since they neither disabled TLS 1.3 nor enabled any of the + ciphersuites it requires. Here we enable the TLS 1.3 ciphersuites. + Closes ticket 24978. + diff --git a/src/common/ciphers.inc b/src/common/ciphers.inc index ab4ac4072..23f5fd2da 100644 --- a/src/common/ciphers.inc +++ b/src/common/ciphers.inc @@ -2,8 +2,27 @@ * advertise. Before including it, you should define the CIPHER and XCIPHER * macros. * - * This file was automatically generated by get_mozilla_ciphers.py. + * This file was automatically generated by get_mozilla_ciphers.py; + * TLSv1.3 ciphers were added manually. */ + +/* Here are the TLS1.3 ciphers. Note that we don't have XCIPHER instances + * here, since we don't want to ever fake them. + */ +#ifdef TLS1_3_TXT_AES_128_GCM_SHA256 + CIPHER(0x1301, TLS1_3_TXT_AES_128_GCM_SHA256) +#endif +#ifdef TLS1_3_TXT_AES_256_GCM_SHA384 + CIPHER(0x1302, TLS1_3_TXT_AES_256_GCM_SHA384) +#endif +#ifdef TLS1_3_TXT_CHACHA20_POLY1305_SHA256 + CIPHER(0x1303, TLS1_3_TXT_CHACHA20_POLY1305_SHA256) +#endif +#ifdef TLS1_3_TXT_AES_128_CCM_SHA256 + CIPHER(0x1304, TLS1_3_TXT_AES_128_CCM_SHA256) +#endif + +/* Here's the machine-generated list. */ #ifdef TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 CIPHER(0xc02b, TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256) #else diff --git a/src/common/tortls.c b/src/common/tortls.c index d61cc2e58..a4e188603 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -550,13 +550,35 @@ MOCK_IMPL(STATIC X509 *, /** List of ciphers that servers should select from when the client might be * claiming extra unsupported ciphers in order to avoid fingerprinting. */ -#define SERVER_CIPHER_LIST \ - (TLS1_TXT_DHE_RSA_WITH_AES_256_SHA ":" \ - TLS1_TXT_DHE_RSA_WITH_AES_128_SHA) +static const char SERVER_CIPHER_LIST[] = +#ifdef TLS1_3_TXT_AES_128_GCM_SHA256 + /* This one can never actually get selected, since if the client lists it, + * we will assume that the client is honest, and not use this list. + * Nonetheless we list it if it's available, so that the server doesn't + * conclude that it has no valid ciphers if it's running with TLS1.3. + */ + TLS1_3_TXT_AES_128_GCM_SHA256 ":" +#endif + TLS1_TXT_DHE_RSA_WITH_AES_256_SHA ":" + TLS1_TXT_DHE_RSA_WITH_AES_128_SHA; /** List of ciphers that servers should select from when we actually have * our choice of what cipher to use. */ static const char UNRESTRICTED_SERVER_CIPHER_LIST[] = + /* Here are the TLS 1.3 ciphers we like, in the order we prefer. */ +#ifdef TLS1_3_TXT_AES_256_GCM_SHA384 + TLS1_3_TXT_AES_256_GCM_SHA384 ":" +#endif +#ifdef TLS1_3_TXT_CHACHA20_POLY1305_SHA256 + TLS1_3_TXT_CHACHA20_POLY1305_SHA256 ":" +#endif +#ifdef TLS1_3_TXT_AES_128_GCM_SHA256 + TLS1_3_TXT_AES_128_GCM_SHA256 ":" +#endif +#ifdef TLS1_3_TXT_AES_128_CCM_SHA256 + TLS1_3_TXT_AES_128_CCM_SHA256 ":" +#endif + /* This list is autogenerated with the gen_server_ciphers.py script; * don't hand-edit it. */ #ifdef TLS1_TXT_ECDHE_RSA_WITH_AES_256_GCM_SHA384

1 0

[tor/maint-0.2.9] Merge branch 'bug24978_029_enable' into maint-0.2.9
by nickm＠torproject.org 10 Feb '18

10 Feb '18

commit 320dac4602dd26bc64f1f0fd1cff5d7b38bb09eb Merge: 0ddc2dc53 0dbe3ddc3 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sat Feb 10 16:08:58 2018 -0500 Merge branch 'bug24978_029_enable' into maint-0.2.9 changes/bug24978 | 7 +++++++ src/common/ciphers.inc | 21 ++++++++++++++++++++- src/common/tortls.c | 28 +++++++++++++++++++++++++--- 3 files changed, 52 insertions(+), 4 deletions(-)

1 0

[tor/maint-0.3.2] Make Tor support TLS1.3 ciphers with OpenSSL 1.1.1
by nickm＠torproject.org 10 Feb '18

10 Feb '18

commit 0dbe3ddc334d5e343c2a926e972cc20cb131a42a Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jan 23 09:23:21 2018 -0500 Make Tor support TLS1.3 ciphers with OpenSSL 1.1.1 Without this patch, not only will TLS1.3 not work with Tor, but OpenSSL 1.1.1 with TLS1.3 enabled won't build any connections at all: It requires that either TLS1.3 be disabled, or some TLS1.3 ciphersuites be listed. Closes ticket 24978. --- changes/bug24978 | 7 +++++++ src/common/ciphers.inc | 21 ++++++++++++++++++++- src/common/tortls.c | 28 +++++++++++++++++++++++++--- 3 files changed, 52 insertions(+), 4 deletions(-) diff --git a/changes/bug24978 b/changes/bug24978 new file mode 100644 index 000000000..5dc45c744 --- /dev/null +++ b/changes/bug24978 @@ -0,0 +1,7 @@ + o Minor features (compatibility, OpenSSL): + - Tor will now support TLS1.3 once OpenSSL 1.1.1 is released. + Previous versions of Tor would not have worked with OpenSSL + 1.1.1, since they neither disabled TLS 1.3 nor enabled any of the + ciphersuites it requires. Here we enable the TLS 1.3 ciphersuites. + Closes ticket 24978. + diff --git a/src/common/ciphers.inc b/src/common/ciphers.inc index ab4ac4072..23f5fd2da 100644 --- a/src/common/ciphers.inc +++ b/src/common/ciphers.inc @@ -2,8 +2,27 @@ * advertise. Before including it, you should define the CIPHER and XCIPHER * macros. * - * This file was automatically generated by get_mozilla_ciphers.py. + * This file was automatically generated by get_mozilla_ciphers.py; + * TLSv1.3 ciphers were added manually. */ + +/* Here are the TLS1.3 ciphers. Note that we don't have XCIPHER instances + * here, since we don't want to ever fake them. + */ +#ifdef TLS1_3_TXT_AES_128_GCM_SHA256 + CIPHER(0x1301, TLS1_3_TXT_AES_128_GCM_SHA256) +#endif +#ifdef TLS1_3_TXT_AES_256_GCM_SHA384 + CIPHER(0x1302, TLS1_3_TXT_AES_256_GCM_SHA384) +#endif +#ifdef TLS1_3_TXT_CHACHA20_POLY1305_SHA256 + CIPHER(0x1303, TLS1_3_TXT_CHACHA20_POLY1305_SHA256) +#endif +#ifdef TLS1_3_TXT_AES_128_CCM_SHA256 + CIPHER(0x1304, TLS1_3_TXT_AES_128_CCM_SHA256) +#endif + +/* Here's the machine-generated list. */ #ifdef TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 CIPHER(0xc02b, TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256) #else diff --git a/src/common/tortls.c b/src/common/tortls.c index d61cc2e58..a4e188603 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -550,13 +550,35 @@ MOCK_IMPL(STATIC X509 *, /** List of ciphers that servers should select from when the client might be * claiming extra unsupported ciphers in order to avoid fingerprinting. */ -#define SERVER_CIPHER_LIST \ - (TLS1_TXT_DHE_RSA_WITH_AES_256_SHA ":" \ - TLS1_TXT_DHE_RSA_WITH_AES_128_SHA) +static const char SERVER_CIPHER_LIST[] = +#ifdef TLS1_3_TXT_AES_128_GCM_SHA256 + /* This one can never actually get selected, since if the client lists it, + * we will assume that the client is honest, and not use this list. + * Nonetheless we list it if it's available, so that the server doesn't + * conclude that it has no valid ciphers if it's running with TLS1.3. + */ + TLS1_3_TXT_AES_128_GCM_SHA256 ":" +#endif + TLS1_TXT_DHE_RSA_WITH_AES_256_SHA ":" + TLS1_TXT_DHE_RSA_WITH_AES_128_SHA; /** List of ciphers that servers should select from when we actually have * our choice of what cipher to use. */ static const char UNRESTRICTED_SERVER_CIPHER_LIST[] = + /* Here are the TLS 1.3 ciphers we like, in the order we prefer. */ +#ifdef TLS1_3_TXT_AES_256_GCM_SHA384 + TLS1_3_TXT_AES_256_GCM_SHA384 ":" +#endif +#ifdef TLS1_3_TXT_CHACHA20_POLY1305_SHA256 + TLS1_3_TXT_CHACHA20_POLY1305_SHA256 ":" +#endif +#ifdef TLS1_3_TXT_AES_128_GCM_SHA256 + TLS1_3_TXT_AES_128_GCM_SHA256 ":" +#endif +#ifdef TLS1_3_TXT_AES_128_CCM_SHA256 + TLS1_3_TXT_AES_128_CCM_SHA256 ":" +#endif + /* This list is autogenerated with the gen_server_ciphers.py script; * don't hand-edit it. */ #ifdef TLS1_TXT_ECDHE_RSA_WITH_AES_256_GCM_SHA384

1 0

[tor/maint-0.3.2] Merge branch 'bug24978_029_enable' into maint-0.2.9
by nickm＠torproject.org 10 Feb '18

10 Feb '18

commit 320dac4602dd26bc64f1f0fd1cff5d7b38bb09eb Merge: 0ddc2dc53 0dbe3ddc3 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sat Feb 10 16:08:58 2018 -0500 Merge branch 'bug24978_029_enable' into maint-0.2.9 changes/bug24978 | 7 +++++++ src/common/ciphers.inc | 21 ++++++++++++++++++++- src/common/tortls.c | 28 +++++++++++++++++++++++++--- 3 files changed, 52 insertions(+), 4 deletions(-)

1 0

[tor/maint-0.3.2] Merge branch 'maint-0.2.9' into maint-0.3.1
by nickm＠torproject.org 10 Feb '18

10 Feb '18

commit 86583ad78e6c75ea0094553584428f795089c482 Merge: 04a8e81fa 320dac460 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sat Feb 10 16:09:00 2018 -0500 Merge branch 'maint-0.2.9' into maint-0.3.1 changes/bug24978 | 7 +++++++ src/common/ciphers.inc | 21 ++++++++++++++++++++- src/common/tortls.c | 28 +++++++++++++++++++++++++--- 3 files changed, 52 insertions(+), 4 deletions(-)

1 0

[tor/master] Merge branch 'bug24978_029_enable' into maint-0.2.9
by nickm＠torproject.org 10 Feb '18

10 Feb '18

commit 320dac4602dd26bc64f1f0fd1cff5d7b38bb09eb Merge: 0ddc2dc53 0dbe3ddc3 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sat Feb 10 16:08:58 2018 -0500 Merge branch 'bug24978_029_enable' into maint-0.2.9 changes/bug24978 | 7 +++++++ src/common/ciphers.inc | 21 ++++++++++++++++++++- src/common/tortls.c | 28 +++++++++++++++++++++++++--- 3 files changed, 52 insertions(+), 4 deletions(-)

1 0