May 2018 - tor-commits - lists.torproject.org

[tor/master] LibreSSL compatibility fixes.
by nickm＠torproject.org 09 May '18

09 May '18

commit 75f3fbaa3c7316fcef3509ef1e3813b94d8c4c8a Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed May 2 08:18:48 2018 -0400 LibreSSL compatibility fixes. LibreSSL, despite not having the OpenSSL 1.1 API, does define OPENSSL_VERSION in crypto.h. Additionally, it apparently annotates some functions as returning NULL, so that our unit tests need to be more careful about checking for NULL so they don't get compilation warnings. Closes ticket 26006. --- changes/ticket26006 | 4 ++++ src/common/compat_openssl.h | 7 ++++++- src/test/test_tortls.c | 3 +++ 3 files changed, 13 insertions(+), 1 deletion(-) diff --git a/changes/ticket26006 b/changes/ticket26006 new file mode 100644 index 000000000..e33e3f1cd --- /dev/null +++ b/changes/ticket26006 @@ -0,0 +1,4 @@ + o Minor features (compilation, portability): + - Avoid some compilation warnings with recent versions + of LibreSSL. Closes ticket 26006. + diff --git a/src/common/compat_openssl.h b/src/common/compat_openssl.h index 1bfe18807..76679872b 100644 --- a/src/common/compat_openssl.h +++ b/src/common/compat_openssl.h @@ -8,6 +8,8 @@ #define TOR_COMPAT_OPENSSL_H #include <openssl/opensslv.h> +// workaround for libressl; not needed in later Tor versions. +#include <openssl/crypto.h> /** * \file compat_openssl.h @@ -27,8 +29,11 @@ #define OPENSSL_1_1_API #endif -#ifndef OPENSSL_1_1_API +#ifndef OPENSSL_VERSION #define OPENSSL_VERSION SSLEAY_VERSION +#endif + +#ifndef OPENSSL_1_1_API #define OpenSSL_version(v) SSLeay_version(v) #define OpenSSL_version_num() SSLeay() #define RAND_OpenSSL() RAND_SSLeay() diff --git a/src/test/test_tortls.c b/src/test/test_tortls.c index 47455cff8..5028a9540 100644 --- a/src/test/test_tortls.c +++ b/src/test/test_tortls.c @@ -840,8 +840,10 @@ test_tortls_classify_client_ciphers(void *ignored) sk_SSL_CIPHER_zero(ciphers); one = get_cipher_by_name("ECDHE-RSA-AES256-GCM-SHA384"); + tt_assert(one); one->id = 0x00ff; two = get_cipher_by_name("ECDHE-RSA-AES128-GCM-SHA256"); + tt_assert(two); two->id = 0x0000; sk_SSL_CIPHER_push(ciphers, one); tls->client_cipher_list_type = 0; @@ -912,6 +914,7 @@ test_tortls_client_is_using_v2_ciphers(void *ignored) ciphers = sk_SSL_CIPHER_new_null(); SSL_CIPHER *one = get_cipher_by_name("ECDHE-RSA-AES256-GCM-SHA384"); + tt_assert(one); one->id = 0x00ff; sk_SSL_CIPHER_push(ciphers, one); sess->ciphers = ciphers;

1 0

[tor/master] Merge branch 'libressl_201805_033' into maint-0.3.3
by nickm＠torproject.org 09 May '18

09 May '18

commit a639a67844909bd05fadaea5c1847f5e9af55cde Merge: b979415e8 bf3e899dc Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed May 9 08:25:32 2018 -0400 Merge branch 'libressl_201805_033' into maint-0.3.3 changes/ticket26006 | 4 ++++ src/common/compat_openssl.h | 6 +++++- src/test/test_tortls.c | 3 +++ 3 files changed, 12 insertions(+), 1 deletion(-)

1 0

[tor/release-0.3.3] Merge branch 'libressl_201805_029' into maint-0.3.3
by nickm＠torproject.org 09 May '18

09 May '18

commit bf3e899dcef368a021033c6845b93c08884dae02 Merge: b116710e3 75f3fbaa3 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed May 2 08:26:49 2018 -0400 Merge branch 'libressl_201805_029' into maint-0.3.3 changes/ticket26006 | 4 ++++ src/common/compat_openssl.h | 6 +++++- src/test/test_tortls.c | 3 +++ 3 files changed, 12 insertions(+), 1 deletion(-) diff --cc src/common/compat_openssl.h index 1299ac36b,76679872b..d1481fb46 --- a/src/common/compat_openssl.h +++ b/src/common/compat_openssl.h @@@ -8,7 -8,9 +8,8 @@@ #define TOR_COMPAT_OPENSSL_H #include <openssl/opensslv.h> -// workaround for libressl; not needed in later Tor versions. -#include <openssl/crypto.h> +#include "crypto_openssl_mgt.h" + /** * \file compat_openssl.h * @@@ -25,10 -27,13 +26,13 @@@ /* We define this macro if we're trying to build with the majorly refactored * API in OpenSSL 1.1 */ #define OPENSSL_1_1_API -#endif +#endif /* OPENSSL_VERSION_NUMBER >= OPENSSL_V_SERIES(1,1,0) && ... */ - #ifndef OPENSSL_1_1_API + #ifndef OPENSSL_VERSION #define OPENSSL_VERSION SSLEAY_VERSION + #endif + + #ifndef OPENSSL_1_1_API #define OpenSSL_version(v) SSLeay_version(v) #define OpenSSL_version_num() SSLeay() #define RAND_OpenSSL() RAND_SSLeay()

1 0

[tor/master] Merge branch 'libressl_201805_029' into maint-0.3.3
by nickm＠torproject.org 09 May '18

09 May '18

commit bf3e899dcef368a021033c6845b93c08884dae02 Merge: b116710e3 75f3fbaa3 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed May 2 08:26:49 2018 -0400 Merge branch 'libressl_201805_029' into maint-0.3.3 changes/ticket26006 | 4 ++++ src/common/compat_openssl.h | 6 +++++- src/test/test_tortls.c | 3 +++ 3 files changed, 12 insertions(+), 1 deletion(-) diff --cc src/common/compat_openssl.h index 1299ac36b,76679872b..d1481fb46 --- a/src/common/compat_openssl.h +++ b/src/common/compat_openssl.h @@@ -8,7 -8,9 +8,8 @@@ #define TOR_COMPAT_OPENSSL_H #include <openssl/opensslv.h> -// workaround for libressl; not needed in later Tor versions. -#include <openssl/crypto.h> +#include "crypto_openssl_mgt.h" + /** * \file compat_openssl.h * @@@ -25,10 -27,13 +26,13 @@@ /* We define this macro if we're trying to build with the majorly refactored * API in OpenSSL 1.1 */ #define OPENSSL_1_1_API -#endif +#endif /* OPENSSL_VERSION_NUMBER >= OPENSSL_V_SERIES(1,1,0) && ... */ - #ifndef OPENSSL_1_1_API + #ifndef OPENSSL_VERSION #define OPENSSL_VERSION SSLEAY_VERSION + #endif + + #ifndef OPENSSL_1_1_API #define OpenSSL_version(v) SSLeay_version(v) #define OpenSSL_version_num() SSLeay() #define RAND_OpenSSL() RAND_SSLeay()

1 0

[tor/release-0.3.3] LibreSSL compatibility fixes.
by nickm＠torproject.org 09 May '18

09 May '18

commit 75f3fbaa3c7316fcef3509ef1e3813b94d8c4c8a Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed May 2 08:18:48 2018 -0400 LibreSSL compatibility fixes. LibreSSL, despite not having the OpenSSL 1.1 API, does define OPENSSL_VERSION in crypto.h. Additionally, it apparently annotates some functions as returning NULL, so that our unit tests need to be more careful about checking for NULL so they don't get compilation warnings. Closes ticket 26006. --- changes/ticket26006 | 4 ++++ src/common/compat_openssl.h | 7 ++++++- src/test/test_tortls.c | 3 +++ 3 files changed, 13 insertions(+), 1 deletion(-) diff --git a/changes/ticket26006 b/changes/ticket26006 new file mode 100644 index 000000000..e33e3f1cd --- /dev/null +++ b/changes/ticket26006 @@ -0,0 +1,4 @@ + o Minor features (compilation, portability): + - Avoid some compilation warnings with recent versions + of LibreSSL. Closes ticket 26006. + diff --git a/src/common/compat_openssl.h b/src/common/compat_openssl.h index 1bfe18807..76679872b 100644 --- a/src/common/compat_openssl.h +++ b/src/common/compat_openssl.h @@ -8,6 +8,8 @@ #define TOR_COMPAT_OPENSSL_H #include <openssl/opensslv.h> +// workaround for libressl; not needed in later Tor versions. +#include <openssl/crypto.h> /** * \file compat_openssl.h @@ -27,8 +29,11 @@ #define OPENSSL_1_1_API #endif -#ifndef OPENSSL_1_1_API +#ifndef OPENSSL_VERSION #define OPENSSL_VERSION SSLEAY_VERSION +#endif + +#ifndef OPENSSL_1_1_API #define OpenSSL_version(v) SSLeay_version(v) #define OpenSSL_version_num() SSLeay() #define RAND_OpenSSL() RAND_SSLeay() diff --git a/src/test/test_tortls.c b/src/test/test_tortls.c index 47455cff8..5028a9540 100644 --- a/src/test/test_tortls.c +++ b/src/test/test_tortls.c @@ -840,8 +840,10 @@ test_tortls_classify_client_ciphers(void *ignored) sk_SSL_CIPHER_zero(ciphers); one = get_cipher_by_name("ECDHE-RSA-AES256-GCM-SHA384"); + tt_assert(one); one->id = 0x00ff; two = get_cipher_by_name("ECDHE-RSA-AES128-GCM-SHA256"); + tt_assert(two); two->id = 0x0000; sk_SSL_CIPHER_push(ciphers, one); tls->client_cipher_list_type = 0; @@ -912,6 +914,7 @@ test_tortls_client_is_using_v2_ciphers(void *ignored) ciphers = sk_SSL_CIPHER_new_null(); SSL_CIPHER *one = get_cipher_by_name("ECDHE-RSA-AES256-GCM-SHA384"); + tt_assert(one); one->id = 0x00ff; sk_SSL_CIPHER_push(ciphers, one); sess->ciphers = ciphers;

1 0

[tor/master] Merge branch 'maint-0.3.3'
by nickm＠torproject.org 09 May '18

09 May '18

commit 9df20f60762dbd21796bb8c9c621585662e7f708 Merge: e6d634769 a639a6784 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed May 9 08:25:52 2018 -0400 Merge branch 'maint-0.3.3' changes/ticket26006 | 4 ++++ src/common/compat_openssl.h | 6 +++++- src/test/test_tortls.c | 3 +++ 3 files changed, 12 insertions(+), 1 deletion(-)

1 0

[tor/release-0.3.3] Merge branch 'libressl_201805_033' into maint-0.3.3
by nickm＠torproject.org 09 May '18

09 May '18

commit a639a67844909bd05fadaea5c1847f5e9af55cde Merge: b979415e8 bf3e899dc Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed May 9 08:25:32 2018 -0400 Merge branch 'libressl_201805_033' into maint-0.3.3 changes/ticket26006 | 4 ++++ src/common/compat_openssl.h | 6 +++++- src/test/test_tortls.c | 3 +++ 3 files changed, 12 insertions(+), 1 deletion(-)

1 0

[tor/release-0.3.3] Merge branch 'maint-0.3.3' into release-0.3.3
by nickm＠torproject.org 09 May '18

09 May '18

commit 582f784548747bac228d5e5d327d7e7ca039ece5 Merge: 6db0c006b a639a6784 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed May 9 08:26:08 2018 -0400 Merge branch 'maint-0.3.3' into release-0.3.3 changes/ticket26006 | 4 ++++ src/common/compat_openssl.h | 6 +++++- src/test/test_tortls.c | 3 +++ 3 files changed, 12 insertions(+), 1 deletion(-)

1 0

[tor/master] Merge remote-tracking branch 'public/bug26005_034'
by nickm＠torproject.org 09 May '18

09 May '18

commit e6d6347690d085dddb57d087a952750131b80758 Merge: 01d729cbf 89cafc4af Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed May 9 08:23:27 2018 -0400 Merge remote-tracking branch 'public/bug26005_034' src/common/aes.c | 2 +- src/common/crypto.c | 10 +++++----- src/common/tortls.c | 4 ++-- src/test/test_tortls.c | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-)

1 0

[tor/master] Use OPENSSL_1_1_API in place of raw OPENSSL_VERSION_NUMBER checks
by nickm＠torproject.org 09 May '18

09 May '18

commit 89cafc4afac37ee3c9186f5c600cdf2fba1d7d1c Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu May 3 13:33:14 2018 -0400 Use OPENSSL_1_1_API in place of raw OPENSSL_VERSION_NUMBER checks This is needed for libressl-2.6.4 compatibility, which we broke when we merged a15b2c57e1f901c53 to fix bug 19981. Fixes bug 26005; bug not in any released Tor. --- src/common/aes.c | 2 +- src/common/crypto.c | 10 +++++----- src/common/tortls.c | 4 ++-- src/test/test_tortls.c | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-) diff --git a/src/common/aes.c b/src/common/aes.c index 95737cffc..efb4fe855 100644 --- a/src/common/aes.c +++ b/src/common/aes.c @@ -116,7 +116,7 @@ aes_cipher_free_(aes_cnt_cipher_t *cipher_) if (!cipher_) return; EVP_CIPHER_CTX *cipher = (EVP_CIPHER_CTX *) cipher_; -#if OPENSSL_VERSION_NUMBER >= OPENSSL_V_SERIES(1,1,0) +#ifdef OPENSSL_1_1_API EVP_CIPHER_CTX_reset(cipher); #else EVP_CIPHER_CTX_cleanup(cipher); diff --git a/src/common/crypto.c b/src/common/crypto.c index c98a96875..394346502 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -205,7 +205,7 @@ crypto_early_init(void) crypto_early_initialized_ = 1; -#if OPENSSL_VERSION_NUMBER >= OPENSSL_V_SERIES(1,1,0) +#ifdef OPENSSL_1_1_API OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS | OPENSSL_INIT_LOAD_CRYPTO_STRINGS | OPENSSL_INIT_ADD_ALL_CIPHERS | @@ -1668,13 +1668,13 @@ memwipe(void *mem, uint8_t byte, size_t sz) int crypto_global_cleanup(void) { -#if OPENSSL_VERSION_NUMBER < OPENSSL_V_SERIES(1,1,0) +#ifndef OPENSSL_1_1_API EVP_cleanup(); #endif #ifndef NEW_THREAD_API ERR_remove_thread_state(NULL); #endif -#if OPENSSL_VERSION_NUMBER < OPENSSL_V_SERIES(1,1,0) +#ifndef OPENSSL_1_1_API ERR_free_strings(); #endif @@ -1688,13 +1688,13 @@ crypto_global_cleanup(void) dh_param_p = dh_param_p_tls = dh_param_g = NULL; #ifndef DISABLE_ENGINES -#if OPENSSL_VERSION_NUMBER < OPENSSL_V_SERIES(1,1,0) +#ifndef OPENSSL_1_1_API ENGINE_cleanup(); #endif #endif CONF_modules_unload(1); -#if OPENSSL_VERSION_NUMBER < OPENSSL_V_SERIES(1,1,0) +#ifndef OPENSSL_1_1_API CRYPTO_cleanup_all_ex_data(); #endif diff --git a/src/common/tortls.c b/src/common/tortls.c index cd236363f..4044a0e70 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -56,7 +56,7 @@ ENABLE_GCC_WARNING(redundant-decls) #include "container.h" #include <string.h> -#if OPENSSL_VERSION_NUMBER >= OPENSSL_V_SERIES(1,1,0) +#ifdef OPENSSL_1_1_API #define X509_get_notBefore_const(cert) \ X509_get0_notBefore(cert) #define X509_get_notAfter_const(cert) \ @@ -370,7 +370,7 @@ tor_tls_init(void) check_no_tls_errors(); if (!tls_library_is_initialized) { -#if OPENSSL_VERSION_NUMBER >= OPENSSL_V_SERIES(1,1,0) +#ifdef OPENSSL_1_1_API OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL); #else SSL_library_init(); diff --git a/src/test/test_tortls.c b/src/test/test_tortls.c index ef1be139a..ffa641ec4 100644 --- a/src/test/test_tortls.c +++ b/src/test/test_tortls.c @@ -205,7 +205,7 @@ test_tortls_tor_tls_get_error(void *data) static void library_init(void) { -#if OPENSSL_VERSION_NUMBER >= OPENSSL_V_SERIES(1,1,0) +#ifdef OPENSSL_1_1_API OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL); #else SSL_library_init();

1 0