- tor-commits - lists.torproject.org

[githax/master] Fix my make-tor-next script to put stuff in the new real tor-next repo
by nickm＠torproject.org 11 Jun '12

11 Jun '12

commit 973434cfdd24e4d9934f64b43a5bcbf4b918dacc Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jun 11 19:17:41 2012 -0400 Fix my make-tor-next script to put stuff in the new real tor-next repo --- scripts/make-tor-next | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) diff --git a/scripts/make-tor-next b/scripts/make-tor-next index 0b45e34..86652a4 100755 --- a/scripts/make-tor-next +++ b/scripts/make-tor-next @@ -25,7 +25,7 @@ GRANDFATHERED_REPOS = set(""" # What branch do we base tor-next on? BASE_BRANCH = "origin/master" # To which repository do we push the pu branch and the tor-next branch? -TARGET_REPO = "nickm" +TARGET_REPO = "tor-next" logging.basicConfig(level="INFO", format=">>>> %(levelname)s: %(message)s") @@ -143,8 +143,8 @@ except CalledProcessError: logging.info("Build seemed to work. Pushing it!") -subprocess.check_call(["git", "push", "nickm", temp_branch_name]) -subprocess.check_call(["git", "push", "nickm", "+%s:tor-next"%(temp_branch_name)]) +subprocess.check_call(["git", "push", TARGET_REPO, temp_branch_name]) +subprocess.check_call(["git", "push", TARGET_REPO, "+%s:tor-next"%(temp_branch_name)]) logging.info("Pushed tor-next. It's a great big beautiful tomorrow.")

1 0

[tor/master] Call bug5452 fix a feature; note its trac number in the changes file
by nickm＠torproject.org 11 Jun '12

11 Jun '12

commit b44cb4aef8e76131c59a9e8647936bd9d2cf6e18 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jun 11 14:44:08 2012 -0400 Call bug5452 fix a feature; note its trac number in the changes file --- changes/bug5452 | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/changes/bug5452 b/changes/bug5452 index 699c458..8e1d9ad 100644 --- a/changes/bug5452 +++ b/changes/bug5452 @@ -1,4 +1,4 @@ - o Minor bugfixes: + o Minor features: - Check CircuitBuildTimeout and LearnCircuitBuildTimeout in options_validate(); warn if LearnCircuitBuildTimeout is disabled - and CircuitBuildTimeout is set unreasonably low. + and CircuitBuildTimeout is set unreasonably low. Fixes bug 5452.

1 0

[tor/master] Merge branch 'bug5452'
by nickm＠torproject.org 11 Jun '12

11 Jun '12

commit f0f70ba6f1e484a5217952238b22467ba4939d8a Merge: a6dac69 b44cb4a Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jun 11 14:44:26 2012 -0400 Merge branch 'bug5452' changes/bug5452 | 4 ++++ src/or/config.c | 18 ++++++++++++++++++ 2 files changed, 22 insertions(+), 0 deletions(-)

1 0

[tor/master] Add change file for 5452
by nickm＠torproject.org 11 Jun '12

11 Jun '12

commit 997ed7807b187d7b12ec219c876215d9b29e1e06 Author: Andrea Shepard <andrea(a)persephoneslair.org> Date: Mon Jun 11 11:17:59 2012 -0700 Add change file for 5452 --- changes/bug5452 | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-) diff --git a/changes/bug5452 b/changes/bug5452 new file mode 100644 index 0000000..699c458 --- /dev/null +++ b/changes/bug5452 @@ -0,0 +1,4 @@ + o Minor bugfixes: + - Check CircuitBuildTimeout and LearnCircuitBuildTimeout in + options_validate(); warn if LearnCircuitBuildTimeout is disabled + and CircuitBuildTimeout is set unreasonably low.

1 0

[tor/master] Make RECOMMENDED_MIN_CIRCUIT_BUILD_TIMEOUT warning tell the user how to fix it.
by nickm＠torproject.org 11 Jun '12

11 Jun '12

commit 6b73fad7096f4d12f5203b0c11d0e8f9417667b9 Author: Andrea Shepard <andrea(a)persephoneslair.org> Date: Mon Jun 11 11:09:19 2012 -0700 Make RECOMMENDED_MIN_CIRCUIT_BUILD_TIMEOUT warning tell the user how to fix it. --- src/or/config.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) diff --git a/src/or/config.c b/src/or/config.c index 93fcc19..2b14772 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -3727,7 +3727,9 @@ options_validate(or_options_t *old_options, or_options_t *options, options->CircuitBuildTimeout < RECOMMENDED_MIN_CIRCUIT_BUILD_TIMEOUT) { log_warn(LD_CONFIG, "CircuitBuildTimeout is shorter (%d seconds) than recommended " - "(%d seconds), and LearnCircuitBuildTimeout is disabled.", + "(%d seconds), and LearnCircuitBuildTimeout is disabled. " + "If tor isn't working, raise this value or enable " + "LearnCircuitBuildTimeout.", options->CircuitBuildTimeout, RECOMMENDED_MIN_CIRCUIT_BUILD_TIMEOUT ); }

1 0

[tor/master] Warn if the user has set CircuitBuildTimeout stupidly low and turned off LearnCircuitBuildTimeout
by nickm＠torproject.org 11 Jun '12

11 Jun '12

commit 4fb2a14faeb7505e51780fab2c610504edb2646b Author: Andrea Shepard <andrea(a)persephoneslair.org> Date: Fri Jun 8 23:44:06 2012 -0700 Warn if the user has set CircuitBuildTimeout stupidly low and turned off LearnCircuitBuildTimeout --- src/or/config.c | 16 ++++++++++++++++ 1 files changed, 16 insertions(+), 0 deletions(-) diff --git a/src/or/config.c b/src/or/config.c index 090d96c..93fcc19 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -3320,6 +3320,13 @@ compute_publishserverdescriptor(or_options_t *options) * expose more information than we're comfortable with. */ #define MIN_HEARTBEAT_PERIOD (30*60) +/** Lowest recommended value for CircuitBuildTimeout; if it is set too low + * and LearnCircuitBuildTimeout is off, the failure rate for circuit + * construction may be very high. In that case, if it is set below this + * threshold emit a warning. + * */ +#define RECOMMENDED_MIN_CIRCUIT_BUILD_TIMEOUT (10) + /** Return 0 if every setting in <b>options</b> is reasonable, and a * permissible transition from <b>old_options</b>. Else return -1. * Should have no side effects, except for normalizing the contents of @@ -3716,6 +3723,15 @@ options_validate(or_options_t *old_options, or_options_t *options, options->LearnCircuitBuildTimeout = 0; } + if (!(options->LearnCircuitBuildTimeout) && + options->CircuitBuildTimeout < RECOMMENDED_MIN_CIRCUIT_BUILD_TIMEOUT) { + log_warn(LD_CONFIG, + "CircuitBuildTimeout is shorter (%d seconds) than recommended " + "(%d seconds), and LearnCircuitBuildTimeout is disabled.", + options->CircuitBuildTimeout, + RECOMMENDED_MIN_CIRCUIT_BUILD_TIMEOUT ); + } + if (options->MaxCircuitDirtiness < MIN_MAX_CIRCUIT_DIRTINESS) { log_warn(LD_CONFIG, "MaxCircuitDirtiness option is too short; " "raising to %d seconds.", MIN_MAX_CIRCUIT_DIRTINESS);

1 0

[tor/master] Remove a couple of debugging "echo"s that snuck into configure.in
by nickm＠torproject.org 11 Jun '12

11 Jun '12

commit a6dac69aaca088b5cbb8f8914673de03864d95b7 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jun 11 11:30:43 2012 -0400 Remove a couple of debugging "echo"s that snuck into configure.in --- configure.in | 2 -- 1 files changed, 0 insertions(+), 2 deletions(-) diff --git a/configure.in b/configure.in index f365b3f..656a324 100644 --- a/configure.in +++ b/configure.in @@ -526,7 +526,6 @@ TOR_SEARCH_LIBRARY(openssl, $tryssldir, [-lssl -lcrypto $TOR_LIB_GDI], dnl XXXX check for OPENSSL_VERSION_NUMBER == SSLeay() -echo "tor_cv_library_openssl_dir is $tor_cv_library_openssl_dir" if test "$enable_static_openssl" = "yes"; then if test "$tor_cv_library_openssl_dir" = "(system)"; then AC_MSG_ERROR("You must specify an explicit --with-openssl-dir=x option when using --enable-static-openssl") @@ -558,7 +557,6 @@ if test "$enable_static_zlib" = "yes"; then using --enable-static-zlib") else TOR_ZLIB_LIBS="$TOR_LIBDIR_zlib/libz.a" - echo "$TOR_LIBDIR_zlib/libz.a" fi else TOR_ZLIB_LIBS="-lz"

1 0

[tor/master] Treat SW_SERVER_HELLO_B as another sign of an SSL handshake
by nickm＠torproject.org 11 Jun '12

11 Jun '12

commit e3243ad5f6a2c6acfd671e2cab22c4b6a4c21f47 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue May 15 11:13:49 2012 -0400 Treat SW_SERVER_HELLO_B as another sign of an SSL handshake We've been only treating SW_SERVER_HELLO_A as meaning that an SSL handshake was happening. But that's not right: if the initial attempt to write a ServerHello fails, we would get a callback in state SW_SERVER_HELLO_B instead. (That's "instead" and not "in addition": any failed attempt to write the hello will fail and cause the info callback not to get written.) Fix for bug 4592; bugfix on 0.2.0.13-alpha. --- changes/bug4592 | 3 +++ src/common/tortls.c | 3 ++- 2 files changed, 5 insertions(+), 1 deletions(-) diff --git a/changes/bug4592 b/changes/bug4592 new file mode 100644 index 0000000..31140b0 --- /dev/null +++ b/changes/bug4592 @@ -0,0 +1,3 @@ + o Minor bugfixes: + - Detect SSL handshake even when the initial attempt to write the + server hello fails. Fix for bug 4592; bugfix on 0.2.0.13-alpha. diff --git a/src/common/tortls.c b/src/common/tortls.c index 4c9d218..c54ed46 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -951,7 +951,8 @@ tor_tls_server_info_callback(const SSL *ssl, int type, int val) (void) val; if (type != SSL_CB_ACCEPT_LOOP) return; - if (ssl->state != SSL3_ST_SW_SRVR_HELLO_A) + if ((ssl->state != SSL3_ST_SW_SRVR_HELLO_A) && + (ssl->state != SSL3_ST_SW_SRVR_HELLO_B)) return; tls = tor_tls_get_by_ssl(ssl);

1 0

[tor/master] Merge remote-tracking branch 'public/bug4592'
by nickm＠torproject.org 11 Jun '12

11 Jun '12

commit 667a12b471fd457dca5f564702da05a2fd9772d4 Merge: 7091047 e3243ad Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jun 11 10:34:48 2012 -0400 Merge remote-tracking branch 'public/bug4592' changes/bug4592 | 3 +++ src/common/tortls.c | 3 ++- 2 files changed, 5 insertions(+), 1 deletions(-) diff --cc src/common/tortls.c index a62c2e6,c54ed46..b2e43a4 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@@ -1367,12 -949,10 +1367,13 @@@ tor_tls_server_info_callback(const SSL { tor_tls_t *tls; (void) val; + + tor_tls_debug_state_callback(ssl, type, val); + if (type != SSL_CB_ACCEPT_LOOP) return; - if (ssl->state != SSL3_ST_SW_SRVR_HELLO_A) + if ((ssl->state != SSL3_ST_SW_SRVR_HELLO_A) && + (ssl->state != SSL3_ST_SW_SRVR_HELLO_B)) return; tls = tor_tls_get_by_ssl(ssl);

1 0

[tor/master] Change the default for DynamicDHGroups to 0
by nickm＠torproject.org 11 Jun '12

11 Jun '12

commit 8a341cc429879e642862cb16a9de5da889867020 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jun 6 12:00:04 2012 -0400 Change the default for DynamicDHGroups to 0 This feature can make Tor relays less identifiable by their use of the mod_ssl DH group, but at the cost of some usability (#4721) and bridge tracing (#6087) regressions. We should try to turn this on by default again if we find that the mod_ssl group is uncommon and/or we move to a different DH group size (see #6088). Before we can do so, we need a fix for bugs #6087 and Resolves ticket #5598 for now. --- changes/bug5598 | 5 +++++ doc/tor.1.txt | 2 +- src/or/config.c | 2 +- 3 files changed, 7 insertions(+), 2 deletions(-) diff --git a/changes/bug5598 b/changes/bug5598 new file mode 100644 index 0000000..e8e6741 --- /dev/null +++ b/changes/bug5598 @@ -0,0 +1,5 @@ + o Changed defaults: + - Change the default value for DynamicDHGroups to 0. This feature can + make Tor relays less identifiable by their use of the mod_ssl DH + group, but at the cost of some usability (#4721) and bridge tracing + (#6087) regressions. Resolves ticket #5598. diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 00371c3..f5e5b86 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -266,7 +266,7 @@ Other options can be specified either on the command-line (--option If this option is set to 1, when running as a server, generate our own Diffie-Hellman group instead of using the one from Apache's mod_ssl. This option may help circumvent censorship based on static - Diffie-Hellman parameters. (Default: 1). + Diffie-Hellman parameters. (Default: 0). **AlternateDirAuthority** [__nickname__] [**flags**] __address__:__port__ __fingerprint__ + diff --git a/src/or/config.c b/src/or/config.c index 090d96c..cf6ae84 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -257,7 +257,7 @@ static config_var_t _option_vars[] = { V(DisableAllSwap, BOOL, "0"), V(DisableDebuggerAttachment, BOOL, "1"), V(DisableIOCP, BOOL, "1"), - V(DynamicDHGroups, BOOL, "1"), + V(DynamicDHGroups, BOOL, "0"), V(DNSPort, LINELIST, NULL), V(DNSListenAddress, LINELIST, NULL), V(DownloadExtraInfo, BOOL, "0"),

1 0