- tor-commits - lists.torproject.org

[tor/master] Work around a bug in OpenSSL 1.0.1's TLS 1.1 and TLS 1.2 support
by nickm＠torproject.org 04 Jun '12

04 Jun '12

commit 841a8d551abd191b23ad2f78dfb07d9e4ff8ace2 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sat Jun 2 20:05:32 2012 -0400 Work around a bug in OpenSSL 1.0.1's TLS 1.1 and TLS 1.2 support It appears that when OpenSSL negotiates a 1.1 or 1.2 connection, and it decides to renegotiate, the client will send a record with version "1.0" rather than with the current TLS version. This would cause the connection to fail whenever both sides had OpenSSL 1.0.1, and the v2 Tor handshake was in use. As a workaround, disable TLS 1.1 and TLS 1.2. When a later version of OpenSSL is released, we can make this conditional on running a fixed version of OpenSSL. Alternatively, we could disable TLS 1.1 and TLS 1.2 only on the client side. But doing it this way for now means that we not only fix TLS with patched clients; we also fix TLS when the server has this patch and the client does not. That could be important to keep the network running well. Fixes bug 6033. --- changes/bug6033 | 6 ++++++ src/common/tortls.c | 15 +++++++++++++++ 2 files changed, 21 insertions(+), 0 deletions(-) diff --git a/changes/bug6033 b/changes/bug6033 new file mode 100644 index 0000000..56cffd6 --- /dev/null +++ b/changes/bug6033 @@ -0,0 +1,6 @@ + o Major bugfixes: + - Work around a bug in OpenSSL that broke renegotiation with + TLS 1.1 and TLS 1.2. Without this workaround, all attempts + to speak the v2 Tor network protocol when both sides were + using OpenSSL 1.0.1 would fail. Fix for bug 6033, which is + not a bug in Tor. diff --git a/src/common/tortls.c b/src/common/tortls.c index 4c9d218..c631612 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -790,6 +790,21 @@ tor_tls_context_new(crypto_pk_env_t *identity, unsigned int key_lifetime, goto error; SSL_CTX_set_options(result->ctx, SSL_OP_NO_SSLv2); + /* Disable TLS1.1 and TLS1.2 if they exist. We need to do this to + * workaround a bug present in all OpenSSL 1.0.1 versions (as of 1 + * June 2012), wherein renegotiating while using one of these TLS + * protocols will cause the client to send a TLS 1.0 ServerHello + * rather than a ServerHello written with the appropriate protocol + * version. Once some version of OpenSSL does TLS1.1 and TLS1.2 + * renegotiation properly, we can turn them back on when built with + * that version. */ +#ifdef SSL_OP_NO_TLSv1_2 + SSL_CTX_set_options(result->ctx, SSL_OP_NO_TLSv1_2); +#endif +#ifdef SSL_OP_NO_TLSv1_1 + SSL_CTX_set_options(result->ctx, SSL_OP_NO_TLSv1_1); +#endif + if ( #ifdef DISABLE_SSL3_HANDSHAKE 1 ||

1 0

[tor/master] Merge remote-tracking branch 'public/bug6033' into maint-0.2.2
by nickm＠torproject.org 04 Jun '12

04 Jun '12

commit 6d85a796539424882f878ccac5ae4640a6fbb561 Merge: b7e863c 841a8d5 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jun 4 11:33:27 2012 -0400 Merge remote-tracking branch 'public/bug6033' into maint-0.2.2 changes/bug6033 | 6 ++++++ src/common/tortls.c | 15 +++++++++++++++ 2 files changed, 21 insertions(+), 0 deletions(-)

1 0

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.2'
by nickm＠torproject.org 04 Jun '12

04 Jun '12

commit 329e1c65d3c73ad7b3b4cdaa870dd04fd7fb01b7 Merge: 75b72bf 6d85a79 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jun 4 11:36:33 2012 -0400 Merge remote-tracking branch 'origin/maint-0.2.2' changes/bug6033 | 6 ++++++ src/common/tortls.c | 15 +++++++++++++++ 2 files changed, 21 insertions(+), 0 deletions(-)

1 0

[tor/maint-0.2.2] Work around a bug in OpenSSL 1.0.1's TLS 1.1 and TLS 1.2 support
by nickm＠torproject.org 04 Jun '12

04 Jun '12

commit 841a8d551abd191b23ad2f78dfb07d9e4ff8ace2 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sat Jun 2 20:05:32 2012 -0400 Work around a bug in OpenSSL 1.0.1's TLS 1.1 and TLS 1.2 support It appears that when OpenSSL negotiates a 1.1 or 1.2 connection, and it decides to renegotiate, the client will send a record with version "1.0" rather than with the current TLS version. This would cause the connection to fail whenever both sides had OpenSSL 1.0.1, and the v2 Tor handshake was in use. As a workaround, disable TLS 1.1 and TLS 1.2. When a later version of OpenSSL is released, we can make this conditional on running a fixed version of OpenSSL. Alternatively, we could disable TLS 1.1 and TLS 1.2 only on the client side. But doing it this way for now means that we not only fix TLS with patched clients; we also fix TLS when the server has this patch and the client does not. That could be important to keep the network running well. Fixes bug 6033. --- changes/bug6033 | 6 ++++++ src/common/tortls.c | 15 +++++++++++++++ 2 files changed, 21 insertions(+), 0 deletions(-) diff --git a/changes/bug6033 b/changes/bug6033 new file mode 100644 index 0000000..56cffd6 --- /dev/null +++ b/changes/bug6033 @@ -0,0 +1,6 @@ + o Major bugfixes: + - Work around a bug in OpenSSL that broke renegotiation with + TLS 1.1 and TLS 1.2. Without this workaround, all attempts + to speak the v2 Tor network protocol when both sides were + using OpenSSL 1.0.1 would fail. Fix for bug 6033, which is + not a bug in Tor. diff --git a/src/common/tortls.c b/src/common/tortls.c index 4c9d218..c631612 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -790,6 +790,21 @@ tor_tls_context_new(crypto_pk_env_t *identity, unsigned int key_lifetime, goto error; SSL_CTX_set_options(result->ctx, SSL_OP_NO_SSLv2); + /* Disable TLS1.1 and TLS1.2 if they exist. We need to do this to + * workaround a bug present in all OpenSSL 1.0.1 versions (as of 1 + * June 2012), wherein renegotiating while using one of these TLS + * protocols will cause the client to send a TLS 1.0 ServerHello + * rather than a ServerHello written with the appropriate protocol + * version. Once some version of OpenSSL does TLS1.1 and TLS1.2 + * renegotiation properly, we can turn them back on when built with + * that version. */ +#ifdef SSL_OP_NO_TLSv1_2 + SSL_CTX_set_options(result->ctx, SSL_OP_NO_TLSv1_2); +#endif +#ifdef SSL_OP_NO_TLSv1_1 + SSL_CTX_set_options(result->ctx, SSL_OP_NO_TLSv1_1); +#endif + if ( #ifdef DISABLE_SSL3_HANDSHAKE 1 ||

1 0

[tor/maint-0.2.2] Merge remote-tracking branch 'public/bug6033' into maint-0.2.2
by nickm＠torproject.org 04 Jun '12

04 Jun '12

commit 6d85a796539424882f878ccac5ae4640a6fbb561 Merge: b7e863c 841a8d5 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jun 4 11:33:27 2012 -0400 Merge remote-tracking branch 'public/bug6033' into maint-0.2.2 changes/bug6033 | 6 ++++++ src/common/tortls.c | 15 +++++++++++++++ 2 files changed, 21 insertions(+), 0 deletions(-)

1 0

[tor/master] Fix build warning on Lenny about strtok_r unit test
by nickm＠torproject.org 04 Jun '12

04 Jun '12

commit 75b72bf62122c74f4c0c193e9364928aecdba695 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jun 4 11:07:52 2012 -0400 Fix build warning on Lenny about strtok_r unit test This fixes a warning in efb8a09f, where Debain Lenny's GCC doesn't get that for (i=0; i<3; ++i) { const char *p; switch(i) { case 0: p="X"; break; case 1: p="Y"; break; case 2: p="Z"; break; } printf("%s\n", p); } will never try to print an uninitialezed value. Found by buildbots. Bug in no released versions of Tor. --- src/test/test_util.c | 3 +-- 1 files changed, 1 insertions(+), 2 deletions(-) diff --git a/src/test/test_util.c b/src/test/test_util.c index e052692..0d132ee 100644 --- a/src/test/test_util.c +++ b/src/test/test_util.c @@ -1826,10 +1826,9 @@ test_util_strtok(void) char *cp1, *cp2; for (i = 0; i < 3; i++) { - const char *pad1, *pad2; + const char *pad1="", *pad2=""; switch (i) { case 0: - pad1 = pad2 = ""; break; case 1: pad1 = " ";

1 0

[tor/master] clarify that LongLivedPorts is for hidden services too
by arma＠torproject.org 03 Jun '12

03 Jun '12

commit f4db3e263175f3846bdf24de2f1e4788bc764764 Author: Roger Dingledine <arma(a)torproject.org> Date: Sun Jun 3 21:07:34 2012 -0400 clarify that LongLivedPorts is for hidden services too --- doc/tor.1.txt | 6 ++++-- 1 files changed, 4 insertions(+), 2 deletions(-) diff --git a/doc/tor.1.txt b/doc/tor.1.txt index ee38832..00371c3 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -738,8 +738,10 @@ The following options are useful only for clients (that is, if A list of ports for services that tend to have long-running connections (e.g. chat and interactive shells). Circuits for streams that use these ports will contain only high-uptime nodes, to reduce the chance that a node - will go down before the stream is finished. (Default: 21, 22, 706, 1863, - 5050, 5190, 5222, 5223, 6523, 6667, 6697, 8300) + will go down before the stream is finished. Note that the list is also + honored for circuits (both client and service side) involving hidden + services whose virtual port is in this list. (Default: 21, 22, 706, + 1863, 5050, 5190, 5222, 5223, 6523, 6667, 6697, 8300) **MapAddress** __address__ __newaddress__:: When a request for address arrives to Tor, it will transform to newaddress

1 0

r25665: {website} link to the old polipo config file, rather than a 404 (website/trunk/docs/en)
by Roger Dingledine 03 Jun '12

03 Jun '12

Author: arma Date: 2012-06-03 20:41:17 +0000 (Sun, 03 Jun 2012) New Revision: 25665 Modified: website/trunk/docs/en/faq.wml Log: link to the old polipo config file, rather than a 404 Modified: website/trunk/docs/en/faq.wml =================================================================== --- website/trunk/docs/en/faq.wml 2012-06-01 02:42:55 UTC (rev 25664) +++ website/trunk/docs/en/faq.wml 2012-06-03 20:41:17 UTC (rev 25665) @@ -809,7 +809,7 @@ href="http://www.privoxy.org/">privoxy</a> or <a href="https://archive.torproject.org/tor-package-archive/polipo/">polipo</a>. You can use <a -href="https://gitweb.torproject.org/torbrowser.git/blob_plain/HEAD:/build-scripts…">our +href="https://gitweb.torproject.org/torbrowser.git/blob_plain/1ffcd9dafb9dd76c3a2…">our old polipo config file</a> if you like. However, please realize that this approach is not recommended for novice users. </p>

1 0

[ooni-probe/master] Fix scaffolding script
by art＠torproject.org 02 Jun '12

02 Jun '12

commit db4df85cf0ae212226c08291852c5926333537e9 Author: Arturo Filastò <hellais(a)torproject.org> Date: Thu May 31 21:25:03 2012 +0200 Fix scaffolding script --- ooni/scaffolding.py | 19 ++++++++++++------- 1 files changed, 12 insertions(+), 7 deletions(-) diff --git a/ooni/scaffolding.py b/ooni/scaffolding.py index 9004754..b4c5645 100755 --- a/ooni/scaffolding.py +++ b/ooni/scaffolding.py @@ -15,27 +15,31 @@ Safe hacking :). from zope.interface import implements from twisted.python import usage from twisted.plugin import IPlugin -from plugoo.tests import ITest, OONITest +from ooni.plugoo.tests import ITest, OONITest +from ooni.plugoo.assets import Asset +from ooni import log -class %(testName)sArgs(usage.Options): +class %(testShortname)sArgs(usage.Options): optParameters = [['asset', 'a', None, 'Asset file'], ['resume', 'r', 0, 'Resume at this index']] -class %(testName)sTest(OONITest): +class %(testShortname)sTest(OONITest): implements(IPlugin, ITest) - shortName = "%(testShortname)s" + shortName = "%(testSNlower)s" description = "%(testName)s" requirements = None - options = %(testName)sArgs + options = %(testShortname)sArgs blocking = True def control(self, experiment_result, args): # What you return here ends up inside of the report. + log.msg("Running control") return {} def experiment(self, args): # What you return here gets handed as input to control + log.msg("Running experiment") return {} def load_assets(self): @@ -46,14 +50,15 @@ class %(testName)sTest(OONITest): # We need to instantiate it otherwise getPlugins does not detect it # XXX Find a way to load plugins without instantiating them. -%(testShortname)s = %(testName)sTest(None, None, None) +%(testShortname)s = %(testShortname)sTest(None, None, None) """ test_vars = {'testName': None, 'testShortname': None} test_vars['testName'] = raw_input('Test Name: ') test_vars['testShortname'] = raw_input("Test Short Name: ") +test_vars['testSNlower'] = test_vars['testShortname'].lower() -fname = os.path.join('plugins', test_vars['testShortname']+'.py') +fname = os.path.join('plugins', test_vars['testSNlower']+'.py') if os.path.exists(fname): print 'WARNING! File named "%s" already exists.' % fname

1 0

[ooni-probe/master] Add library for date and time related activity
by art＠torproject.org 02 Jun '12

02 Jun '12

commit 460d88ce95a4b759cd2284223829369059dfa535 Author: Arturo Filastò <hellais(a)torproject.org> Date: Thu May 31 21:15:51 2012 +0200 Add library for date and time related activity --- ooni/date.py | 11 +++++++++++ 1 files changed, 11 insertions(+), 0 deletions(-) diff --git a/ooni/date.py b/ooni/date.py new file mode 100644 index 0000000..6f83191 --- /dev/null +++ b/ooni/date.py @@ -0,0 +1,11 @@ +from datetime import datetime + +def pretty_date(): + cur_time = datetime.utcnow() + d_format = "%d %B %Y %H:%M:%S" + pretty = cur_time.strftime(d_format) + return pretty + +def now(): + return datetime.utcnow() +

1 0