- tor-commits - lists.torproject.org

[tor/main] Merge remote-tracking branch 'tor-gitlab/mr/486' into maint-0.3.5
by ahf＠torproject.org 08 Nov '21

08 Nov '21

commit 4914e0e1ccc9ce52ce6c96c53925a5e64f7c6ff6 Merge: 439e17180c 8beb560bfd Author: Alexander Færøy <ahf(a)torproject.org> Date: Mon Nov 8 14:15:56 2021 +0000 Merge remote-tracking branch 'tor-gitlab/mr/486' into maint-0.3.5 changes/bug40429 | 5 +++++ configure.ac | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-)

1 0

[tor/main] Merge branch 'maint-0.3.5' into maint-0.4.5
by ahf＠torproject.org 08 Nov '21

08 Nov '21

commit 882fd1f0d45656e0535e70b5e115281b39ac6307 Merge: a7fe37f1fa 4a24673436 Author: Alexander Færøy <ahf(a)torproject.org> Date: Mon Nov 8 14:16:18 2021 +0000 Merge branch 'maint-0.3.5' into maint-0.4.5 changes/bug40429 | 5 +++++ changes/ticket40511 | 6 ++++++ configure.ac | 14 +++++++++++++- 3 files changed, 24 insertions(+), 1 deletion(-)

1 0

[tor/main] Reverse the direction of the test for openssl 3.0.0
by ahf＠torproject.org 08 Nov '21

08 Nov '21

commit 8beb560bfd19106ab75e13f6bf6230fde93e5fac Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Nov 5 13:23:05 2021 -0400 Reverse the direction of the test for openssl 3.0.0 Previously the logic was reversed, and always gave the wrong answer. This has no other effect than to change whether we suppress deprecated API warnings. Fixes #40429; bugfix on 0.3.5.13. --- changes/bug40429 | 5 +++++ configure.ac | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/changes/bug40429 b/changes/bug40429 new file mode 100644 index 0000000000..9bf3b63818 --- /dev/null +++ b/changes/bug40429 @@ -0,0 +1,5 @@ + o Minor bugfixes (compilation): + - Fix our configuration logic to detect whether we had OpenSSL 3: + previously, our logic was reversed. This has no other effect than to + change whether we suppress deprecated API warnings. Fixes + bug 40429; bugfix on 0.3.5.13. diff --git a/configure.ac b/configure.ac index 930862442c..249a250a2f 100644 --- a/configure.ac +++ b/configure.ac @@ -945,7 +945,7 @@ dnl warnings. AC_MSG_CHECKING([for OpenSSL >= 3.0.0]) AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <openssl/opensslv.h> -#if !defined(LIBRESSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER <= 0x30000000L +#if !defined(LIBRESSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER >= 0x30000000L #error "you_have_version_3" #endif ]], [[]])],

1 0

[tor/main] Give an error message if LibreSSL's TLSv1.3 APIs aren't what we need
by ahf＠torproject.org 08 Nov '21

08 Nov '21

commit cee6e7d9e16fdede9e0c7f319e82bd176de25504 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sat Nov 6 11:04:08 2021 -0400 Give an error message if LibreSSL's TLSv1.3 APIs aren't what we need From LibreSSL versions 3.2.1 through 3.4.0, our configure script would conclude that TLSv1.3 as supported, but it actually wasn't. This led to annoying breakage like #40128 and #40445. Now we give an error message if we try to build with one of those versions. Closes #40511. --- changes/ticket40511 | 6 ++++++ configure.ac | 12 ++++++++++++ 2 files changed, 18 insertions(+) diff --git a/changes/ticket40511 b/changes/ticket40511 new file mode 100644 index 0000000000..756edd874d --- /dev/null +++ b/changes/ticket40511 @@ -0,0 +1,6 @@ + o Minor features (compilation): + - Give an error message if trying to build with a version of LibreSSL + known not to work with Tor. (There's an incompatibility with + LibreSSL versions 3.2.1 through 3.4.0 inclusive because of their + incompatibility with OpenSSL 1.1.1's TLSv1.3 APIs.) + Closes ticket 40511. diff --git a/configure.ac b/configure.ac index 249a250a2f..8ab35bf9dd 100644 --- a/configure.ac +++ b/configure.ac @@ -963,6 +963,18 @@ AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ [ AC_MSG_RESULT([no]) ], [ AC_MSG_ERROR([OpenSSL is too old. We require 1.0.1 or later. You can specify a path to a newer one with --with-openssl-dir.]) ]) +AC_MSG_CHECKING([whether LibreSSL TLS 1.3 APIs are busted]) +AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ +#include <openssl/opensslv.h> +#if defined(LIBRESSL_VERSION_NUMBER) && \ + LIBRESSL_VERSION_NUMBER >= 0x3020100fL && \ + LIBRESSL_VERSION_NUMBER < 0x3040100fL +#error "oh no" +#endif + ]], [[]])], + [ AC_MSG_RESULT([no]) ], + [ AC_MSG_ERROR([This version of LibreSSL won't work with Tor. Please upgrade to LibreSSL 3.4.1 or later. (Or downgrade to 3.2.0 if you really must.)]) ]) + AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <openssl/opensslv.h> #include <openssl/evp.h>

1 0

[tor/maint-0.3.5] Reverse the direction of the test for openssl 3.0.0
by ahf＠torproject.org 08 Nov '21

08 Nov '21

commit 8beb560bfd19106ab75e13f6bf6230fde93e5fac Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Nov 5 13:23:05 2021 -0400 Reverse the direction of the test for openssl 3.0.0 Previously the logic was reversed, and always gave the wrong answer. This has no other effect than to change whether we suppress deprecated API warnings. Fixes #40429; bugfix on 0.3.5.13. --- changes/bug40429 | 5 +++++ configure.ac | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/changes/bug40429 b/changes/bug40429 new file mode 100644 index 0000000000..9bf3b63818 --- /dev/null +++ b/changes/bug40429 @@ -0,0 +1,5 @@ + o Minor bugfixes (compilation): + - Fix our configuration logic to detect whether we had OpenSSL 3: + previously, our logic was reversed. This has no other effect than to + change whether we suppress deprecated API warnings. Fixes + bug 40429; bugfix on 0.3.5.13. diff --git a/configure.ac b/configure.ac index 930862442c..249a250a2f 100644 --- a/configure.ac +++ b/configure.ac @@ -945,7 +945,7 @@ dnl warnings. AC_MSG_CHECKING([for OpenSSL >= 3.0.0]) AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <openssl/opensslv.h> -#if !defined(LIBRESSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER <= 0x30000000L +#if !defined(LIBRESSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER >= 0x30000000L #error "you_have_version_3" #endif ]], [[]])],

1 0

[tor/main] Merge branch 'maint-0.4.5' into maint-0.4.6
by ahf＠torproject.org 08 Nov '21

08 Nov '21

commit a78dafbf7ce5d6fc6d4b6e7ddc7e0714bd377c2e Merge: 77b265f96e 882fd1f0d4 Author: Alexander Færøy <ahf(a)torproject.org> Date: Mon Nov 8 14:16:19 2021 +0000 Merge branch 'maint-0.4.5' into maint-0.4.6 changes/bug40429 | 5 +++++ changes/ticket40511 | 6 ++++++ configure.ac | 14 +++++++++++++- 3 files changed, 24 insertions(+), 1 deletion(-)

1 0

[tor/maint-0.3.5] Merge remote-tracking branch 'tor-gitlab/mr/486' into maint-0.3.5
by ahf＠torproject.org 08 Nov '21

08 Nov '21

commit 4914e0e1ccc9ce52ce6c96c53925a5e64f7c6ff6 Merge: 439e17180c 8beb560bfd Author: Alexander Færøy <ahf(a)torproject.org> Date: Mon Nov 8 14:15:56 2021 +0000 Merge remote-tracking branch 'tor-gitlab/mr/486' into maint-0.3.5 changes/bug40429 | 5 +++++ configure.ac | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-)

1 0

[tor/main] Merge branch 'maint-0.4.6' into main
by ahf＠torproject.org 08 Nov '21

08 Nov '21

commit 9d8b0c5bdc6f75891440dbe53e2572bf54e74aef Merge: d1493f2f27 a78dafbf7c Author: Alexander Færøy <ahf(a)torproject.org> Date: Mon Nov 8 14:16:19 2021 +0000 Merge branch 'maint-0.4.6' into main changes/bug40429 | 5 +++++ changes/ticket40511 | 6 ++++++ configure.ac | 14 +++++++++++++- 3 files changed, 24 insertions(+), 1 deletion(-)

1 0

[tor/maint-0.3.5] Give an error message if LibreSSL's TLSv1.3 APIs aren't what we need
by ahf＠torproject.org 08 Nov '21

08 Nov '21

commit cee6e7d9e16fdede9e0c7f319e82bd176de25504 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sat Nov 6 11:04:08 2021 -0400 Give an error message if LibreSSL's TLSv1.3 APIs aren't what we need From LibreSSL versions 3.2.1 through 3.4.0, our configure script would conclude that TLSv1.3 as supported, but it actually wasn't. This led to annoying breakage like #40128 and #40445. Now we give an error message if we try to build with one of those versions. Closes #40511. --- changes/ticket40511 | 6 ++++++ configure.ac | 12 ++++++++++++ 2 files changed, 18 insertions(+) diff --git a/changes/ticket40511 b/changes/ticket40511 new file mode 100644 index 0000000000..756edd874d --- /dev/null +++ b/changes/ticket40511 @@ -0,0 +1,6 @@ + o Minor features (compilation): + - Give an error message if trying to build with a version of LibreSSL + known not to work with Tor. (There's an incompatibility with + LibreSSL versions 3.2.1 through 3.4.0 inclusive because of their + incompatibility with OpenSSL 1.1.1's TLSv1.3 APIs.) + Closes ticket 40511. diff --git a/configure.ac b/configure.ac index 249a250a2f..8ab35bf9dd 100644 --- a/configure.ac +++ b/configure.ac @@ -963,6 +963,18 @@ AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ [ AC_MSG_RESULT([no]) ], [ AC_MSG_ERROR([OpenSSL is too old. We require 1.0.1 or later. You can specify a path to a newer one with --with-openssl-dir.]) ]) +AC_MSG_CHECKING([whether LibreSSL TLS 1.3 APIs are busted]) +AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ +#include <openssl/opensslv.h> +#if defined(LIBRESSL_VERSION_NUMBER) && \ + LIBRESSL_VERSION_NUMBER >= 0x3020100fL && \ + LIBRESSL_VERSION_NUMBER < 0x3040100fL +#error "oh no" +#endif + ]], [[]])], + [ AC_MSG_RESULT([no]) ], + [ AC_MSG_ERROR([This version of LibreSSL won't work with Tor. Please upgrade to LibreSSL 3.4.1 or later. (Or downgrade to 3.2.0 if you really must.)]) ]) + AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <openssl/opensslv.h> #include <openssl/evp.h>

1 0

[tor/maint-0.4.5] Reverse the direction of the test for openssl 3.0.0
by ahf＠torproject.org 08 Nov '21

08 Nov '21

commit 8beb560bfd19106ab75e13f6bf6230fde93e5fac Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Nov 5 13:23:05 2021 -0400 Reverse the direction of the test for openssl 3.0.0 Previously the logic was reversed, and always gave the wrong answer. This has no other effect than to change whether we suppress deprecated API warnings. Fixes #40429; bugfix on 0.3.5.13. --- changes/bug40429 | 5 +++++ configure.ac | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/changes/bug40429 b/changes/bug40429 new file mode 100644 index 0000000000..9bf3b63818 --- /dev/null +++ b/changes/bug40429 @@ -0,0 +1,5 @@ + o Minor bugfixes (compilation): + - Fix our configuration logic to detect whether we had OpenSSL 3: + previously, our logic was reversed. This has no other effect than to + change whether we suppress deprecated API warnings. Fixes + bug 40429; bugfix on 0.3.5.13. diff --git a/configure.ac b/configure.ac index 930862442c..249a250a2f 100644 --- a/configure.ac +++ b/configure.ac @@ -945,7 +945,7 @@ dnl warnings. AC_MSG_CHECKING([for OpenSSL >= 3.0.0]) AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <openssl/opensslv.h> -#if !defined(LIBRESSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER <= 0x30000000L +#if !defined(LIBRESSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER >= 0x30000000L #error "you_have_version_3" #endif ]], [[]])],

1 0