January 2021 - tor-commits - lists.torproject.org

[tor/release-0.3.5] Include a more modest openssl header in crypto_openssl_mgt.h
by dgoulet＠torproject.org 28 Jan '21

28 Jan '21

commit d9221968ce3daed75d698f333f8bea0bf742ddf3 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Oct 28 10:07:56 2020 -0400 Include a more modest openssl header in crypto_openssl_mgt.h The "engines.h" header has lots of stuff; the "opensslv.h" header has the version number, which is all we actually need here. We need to do this because we're about to change this header to conditionally define OPENSSL_SUPPRESS_DEPRECATED, and it would be too late to do so if we'd already included "engines.h". --- src/lib/crypt_ops/crypto_openssl_mgt.h | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/lib/crypt_ops/crypto_openssl_mgt.h b/src/lib/crypt_ops/crypto_openssl_mgt.h index a3dd03aa04..8dbadfc9d2 100644 --- a/src/lib/crypt_ops/crypto_openssl_mgt.h +++ b/src/lib/crypt_ops/crypto_openssl_mgt.h @@ -16,8 +16,7 @@ #include "orconfig.h" #ifdef ENABLE_OPENSSL -#include <openssl/engine.h> - +#include <openssl/opensslv.h> /* Macro to create an arbitrary OpenSSL version number as used by OPENSSL_VERSION_NUMBER or SSLeay(), since the actual numbers are a bit hard

1 0

[tor/master] Merge branch 'maint-0.4.5'
by dgoulet＠torproject.org 28 Jan '21

28 Jan '21

commit f715b5c0d8f7e3a628482edfbbf5b164ad4dbb1e Merge: e4e6418023 aade1e8108 Author: David Goulet <dgoulet(a)torproject.org> Date: Thu Jan 28 12:04:42 2021 -0500 Merge branch 'maint-0.4.5'

1 0

[tor/release-0.3.5] Changes file for #40165 (openssl deprecation warnings)
by dgoulet＠torproject.org 28 Jan '21

28 Jan '21

commit 59f76a8a1fd0fffe3ccf083bcad49435d6226a8e Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Oct 28 10:34:18 2020 -0400 Changes file for #40165 (openssl deprecation warnings) --- changes/ticket40165 | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/changes/ticket40165 b/changes/ticket40165 new file mode 100644 index 0000000000..a8dd0a339b --- /dev/null +++ b/changes/ticket40165 @@ -0,0 +1,5 @@ + o Minor features (compilation): + - Disable deprecation warnings when building with OpenSSL 3.0.0 or later. + There are a number of newly deprecated APIs in OpenSSL 3.0.0 that Tor + still requires. (A later version of Tor will try to stop depending on + these.) Closes ticket 40165.

1 0

[tor/release-0.3.5] configure: disable OpenSSL deprecation warnings with OpenSSL >= 3
by dgoulet＠torproject.org 28 Jan '21

28 Jan '21

commit e399d32cdf8b77b68345290f59bb315d3ed7a5d9 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Oct 28 10:30:24 2020 -0400 configure: disable OpenSSL deprecation warnings with OpenSSL >= 3 We can't do this in the C headers, since by the time we include `opensslv.h` in order to check the openssl version number, we will have included `openssl/macros.h`, which is the thing that checks whether we disabled deprecation warnings. --- configure.ac | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/configure.ac b/configure.ac index f30a7efa91..6c8456d0c7 100644 --- a/configure.ac +++ b/configure.ac @@ -937,13 +937,30 @@ LIBS="$TOR_OPENSSL_LIBS $LIBS" LDFLAGS="$TOR_LDFLAGS_openssl $LDFLAGS" CPPFLAGS="$TOR_CPPFLAGS_openssl $CPPFLAGS" +dnl Tor currently uses a number of APIs that are deprecated in OpenSSL 3.0.0 +dnl and later. We want to migrate away from them, but that will be a lot of +dnl work. (See ticket tor#40166.) For now, we disable the deprecation +dnl warnings. + +AC_MSG_CHECKING([for OpenSSL >= 3.0.0]) +AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ +#include <openssl/opensslv.h> +#if !defined(LIBRESSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER <= 0x30000000L +#error "you_have_version_3" +#endif + ]], [[]])], + [ AC_MSG_RESULT([no]) ], + [ AC_MSG_RESULT([yes]); + AC_DEFINE(OPENSSL_SUPPRESS_DEPRECATED, 1, [disable openssl deprecated-function warnings]) ]) + +AC_MSG_CHECKING([for OpenSSL < 1.0.1]) AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <openssl/opensslv.h> #if !defined(LIBRESSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER < 0x1000100fL #error "too old" #endif ]], [[]])], - [ : ], + [ AC_MSG_RESULT([no]) ], [ AC_MSG_ERROR([OpenSSL is too old. We require 1.0.1 or later. You can specify a path to a newer one with --with-openssl-dir.]) ]) AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[

1 0

[tor/release-0.3.5] Do not define OPENSSL_VERSION in compat_openssl.h
by dgoulet＠torproject.org 28 Jan '21

28 Jan '21

commit 2b4a3d07b25ae9c284a1f130de71940242b78bb7 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Oct 28 10:32:06 2020 -0400 Do not define OPENSSL_VERSION in compat_openssl.h Apparently it conflicts with definitions elsewhere in Openssl 3.0.0. --- src/lib/crypt_ops/compat_openssl.h | 5 ----- src/lib/crypt_ops/crypto_openssl_mgt.c | 13 +++++++++++-- 2 files changed, 11 insertions(+), 7 deletions(-) diff --git a/src/lib/crypt_ops/compat_openssl.h b/src/lib/crypt_ops/compat_openssl.h index 9c10386c34..6605d01045 100644 --- a/src/lib/crypt_ops/compat_openssl.h +++ b/src/lib/crypt_ops/compat_openssl.h @@ -32,10 +32,6 @@ #define OPENSSL_1_1_API #endif /* OPENSSL_VERSION_NUMBER >= OPENSSL_V_SERIES(1,1,0) && ... */ -#ifndef OPENSSL_VERSION -#define OPENSSL_VERSION SSLEAY_VERSION -#endif - #ifndef OPENSSL_1_1_API #define OpenSSL_version(v) SSLeay_version(v) #define OpenSSL_version_num() SSLeay() @@ -54,4 +50,3 @@ #endif /* defined(ENABLE_OPENSSL) */ #endif /* !defined(TOR_COMPAT_OPENSSL_H) */ - diff --git a/src/lib/crypt_ops/crypto_openssl_mgt.c b/src/lib/crypt_ops/crypto_openssl_mgt.c index c97815f9a4..e7d6084f6c 100644 --- a/src/lib/crypt_ops/crypto_openssl_mgt.c +++ b/src/lib/crypt_ops/crypto_openssl_mgt.c @@ -101,13 +101,22 @@ static char *crypto_openssl_version_str = NULL; const char * crypto_openssl_get_version_str(void) { +#ifdef OPENSSL_VERSION + const int query = OPENSSL_VERSION; +#else + /* This old name was changed around OpenSSL 1.1.0 */ + const int query = SSLEAY_VERSION; +#endif + if (crypto_openssl_version_str == NULL) { - const char *raw_version = OpenSSL_version(OPENSSL_VERSION); + const char *raw_version = OpenSSL_version(query); crypto_openssl_version_str = parse_openssl_version_str(raw_version); } return crypto_openssl_version_str; } +#undef QUERY_OPENSSL_VERSION + static char *crypto_openssl_header_version_str = NULL; /* Return a human-readable version of the compile-time openssl version * number. */ @@ -208,7 +217,7 @@ crypto_openssl_early_init(void) setup_openssl_threading(); unsigned long version_num = OpenSSL_version_num(); - const char *version_str = OpenSSL_version(OPENSSL_VERSION); + const char *version_str = crypto_openssl_get_version_str(); if (version_num == OPENSSL_VERSION_NUMBER && !strcmp(version_str, OPENSSL_VERSION_TEXT)) { log_info(LD_CRYPTO, "OpenSSL version matches version from headers "

1 0

[tor/release-0.3.5] Merge branch 'tor-gitlab/mr/186' into maint-0.3.5
by dgoulet＠torproject.org 28 Jan '21

28 Jan '21

commit 2cf1365c17822f5e925c4c0bc3bd0367a3a657a8 Merge: 3ebf75993f c48d25ac8d Author: David Goulet <dgoulet(a)torproject.org> Date: Thu Jan 28 12:00:10 2021 -0500 Merge branch 'tor-gitlab/mr/186' into maint-0.3.5 changes/ticket40165 | 5 +++++ changes/ticket40170 | 3 +++ configure.ac | 19 ++++++++++++++++++- src/lib/crypt_ops/compat_openssl.h | 5 ----- src/lib/crypt_ops/crypto_openssl_mgt.c | 13 +++++++++++-- src/lib/crypt_ops/crypto_openssl_mgt.h | 3 +-- src/test/test_tortls_openssl.c | 3 +-- 7 files changed, 39 insertions(+), 12 deletions(-)

1 0

[tor/release-0.3.5] Fix a previously overstrict log message check.
by dgoulet＠torproject.org 28 Jan '21

28 Jan '21

commit c48d25ac8d5cb8320a56a61cbee7754420d77309 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Oct 28 10:47:39 2020 -0400 Fix a previously overstrict log message check. OpenSSL doesn't seem to report error locations in the same way as before, which broke one of our tests. Fixes bug 40170; bugfix on 0.2.8.1-alpha. --- changes/ticket40170 | 3 +++ src/test/test_tortls_openssl.c | 3 +-- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/changes/ticket40170 b/changes/ticket40170 new file mode 100644 index 0000000000..cc1c8dbad1 --- /dev/null +++ b/changes/ticket40170 @@ -0,0 +1,3 @@ + o Minor bugfixes (tests): + - Fix the "tortls/openssl/log_one_error" test to work with OpenSSL 3.0.0. + Fixes bug 40170; bugfix on 0.2.8.1-alpha. diff --git a/src/test/test_tortls_openssl.c b/src/test/test_tortls_openssl.c index f039980a25..f4e3430dac 100644 --- a/src/test/test_tortls_openssl.c +++ b/src/test/test_tortls_openssl.c @@ -283,8 +283,7 @@ test_tortls_log_one_error(void *ignored) mock_clean_saved_logs(); tor_tls_log_one_error(tls, ERR_PACK(1, 2, 3), LOG_WARN, 0, NULL); - expect_log_msg("TLS error with 127.hello: " - "BN lib (in unknown library:(null):---)\n"); + expect_log_msg_containing("TLS error with 127.hello"); mock_clean_saved_logs(); tor_tls_log_one_error(tls, ERR_PACK(1, 2, SSL_R_HTTP_REQUEST),

1 0

[tor/release-0.4.3] Merge branch 'tor-gitlab/mr/186' into maint-0.3.5
by dgoulet＠torproject.org 28 Jan '21

28 Jan '21

commit 2cf1365c17822f5e925c4c0bc3bd0367a3a657a8 Merge: 3ebf75993f c48d25ac8d Author: David Goulet <dgoulet(a)torproject.org> Date: Thu Jan 28 12:00:10 2021 -0500 Merge branch 'tor-gitlab/mr/186' into maint-0.3.5 changes/ticket40165 | 5 +++++ changes/ticket40170 | 3 +++ configure.ac | 19 ++++++++++++++++++- src/lib/crypt_ops/compat_openssl.h | 5 ----- src/lib/crypt_ops/crypto_openssl_mgt.c | 13 +++++++++++-- src/lib/crypt_ops/crypto_openssl_mgt.h | 3 +-- src/test/test_tortls_openssl.c | 3 +-- 7 files changed, 39 insertions(+), 12 deletions(-)

1 0

[tor/release-0.4.3] statistics: Properly count all rendezvous cells (avoid undercounting).
by dgoulet＠torproject.org 28 Jan '21

28 Jan '21

commit 248cbc2d2207a0bc3374cd18a17cda9d1b8a8ef1 Author: George Kadianakis <desnacked(a)riseup.net> Date: Mon Sep 7 13:17:41 2020 +0300 statistics: Properly count all rendezvous cells (avoid undercounting). tl;dr We were not counting cells flying from the client to the service, but we were counting cells flying from the service to the client. When a rendezvous cell arrives from the client to the RP, the RP forwards it to the service. For this to happen, the cell first passes through command_process_relay_cell() which normally does the statistics counting. However because the `rend_circ` circuit was not flagged with `circuit_carries_hs_traffic_stats` in rend_mid_rendezvous(), the cell is not counted there. Then the cell goes to circuit_receive_relay_cell() which has a special code block based on `rend_splice` specifically for rendezvous cells, and the cell gets directly passed to `rend_circ` via a direct call to circuit_receive_relay_cell(). The cell never passes through command_process_relay_cell() ever again and hence is never counted by our rephist module. The fix here is to flag the `rend_circ` circuit with `circuit_carries_hs_traffic_stats` so that the cell is counted as soon as it hits command_process_relay_cell(). Furthermore we avoid double-counting cells since the special code block of circuit_receive_relay_cell() makes us count rendezvous cells only as they enter the RP and not as they exit it. Fixes #40117. --- changes/bug40117 | 5 +++++ src/feature/rend/rendmid.c | 6 ++++-- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/changes/bug40117 b/changes/bug40117 new file mode 100644 index 0000000000..77646edf9c --- /dev/null +++ b/changes/bug40117 @@ -0,0 +1,5 @@ + o Major bugfixes (stats, onion services): + - Fix a bug where we were undercounting the Tor network's total onion + service traffic, by only counting rendezvous traffic originating from + services and ignoring any traffic originating from clients. Fixes bug + 40117; bugfix on 0.2.6.2-alpha. diff --git a/src/feature/rend/rendmid.c b/src/feature/rend/rendmid.c index 3ba48f8858..af02b34e6b 100644 --- a/src/feature/rend/rendmid.c +++ b/src/feature/rend/rendmid.c @@ -333,10 +333,12 @@ rend_mid_rendezvous(or_circuit_t *circ, const uint8_t *request, goto err; } - /* Statistics: Mark this circuit as an RP circuit so that we collect - stats from it. */ + /* Statistics: Mark circuits as RP circuits */ if (options->HiddenServiceStatistics) { + /* `circ` is the RP <-> service circuit */ circ->circuit_carries_hs_traffic_stats = 1; + /* `rend_circ` is the client <-> RP circuit */ + rend_circ->circuit_carries_hs_traffic_stats = 1; } /* Send the RENDEZVOUS2 cell to the client. */

1 0

[tor/release-0.4.3] Fix a previously overstrict log message check.
by dgoulet＠torproject.org 28 Jan '21

28 Jan '21

commit c48d25ac8d5cb8320a56a61cbee7754420d77309 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Oct 28 10:47:39 2020 -0400 Fix a previously overstrict log message check. OpenSSL doesn't seem to report error locations in the same way as before, which broke one of our tests. Fixes bug 40170; bugfix on 0.2.8.1-alpha. --- changes/ticket40170 | 3 +++ src/test/test_tortls_openssl.c | 3 +-- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/changes/ticket40170 b/changes/ticket40170 new file mode 100644 index 0000000000..cc1c8dbad1 --- /dev/null +++ b/changes/ticket40170 @@ -0,0 +1,3 @@ + o Minor bugfixes (tests): + - Fix the "tortls/openssl/log_one_error" test to work with OpenSSL 3.0.0. + Fixes bug 40170; bugfix on 0.2.8.1-alpha. diff --git a/src/test/test_tortls_openssl.c b/src/test/test_tortls_openssl.c index f039980a25..f4e3430dac 100644 --- a/src/test/test_tortls_openssl.c +++ b/src/test/test_tortls_openssl.c @@ -283,8 +283,7 @@ test_tortls_log_one_error(void *ignored) mock_clean_saved_logs(); tor_tls_log_one_error(tls, ERR_PACK(1, 2, 3), LOG_WARN, 0, NULL); - expect_log_msg("TLS error with 127.hello: " - "BN lib (in unknown library:(null):---)\n"); + expect_log_msg_containing("TLS error with 127.hello"); mock_clean_saved_logs(); tor_tls_log_one_error(tls, ERR_PACK(1, 2, SSL_R_HTTP_REQUEST),

1 0