- tor-commits - lists.torproject.org

[metrics-lib/master] Fix download logic a bit.
by karsten＠torproject.org 10 Jan '12

10 Jan '12

commit 088bc8ecb475bdf222f9a81b837229273bbbc0cd Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Tue Jan 10 10:19:18 2012 +0100 Fix download logic a bit. Now we report a failed request instead of silently ignoring it. As a result, we don't wait forever if we cannot download a single consensus. The download logic is still somewhat broken. We don't wait for all consensus requests to complete or fail, which results in adding (failed) requests to the queue when we think we're done. This is probably harmless, but should be fixed at some point. --- .../impl/RelayDescriptorDownloaderImpl.java | 22 +++++++++++++------ 1 files changed, 15 insertions(+), 7 deletions(-) diff --git a/src/org/torproject/descriptor/impl/RelayDescriptorDownloaderImpl.java b/src/org/torproject/descriptor/impl/RelayDescriptorDownloaderImpl.java index c2db6a4..6805cc4 100644 --- a/src/org/torproject/descriptor/impl/RelayDescriptorDownloaderImpl.java +++ b/src/org/torproject/descriptor/impl/RelayDescriptorDownloaderImpl.java @@ -430,13 +430,18 @@ public class RelayDescriptorDownloaderImpl this.missingVotes.add(requestedVote); } } - this.descriptorQueue.add(response); + if (response.getRequestEnd() != 0L) { + this.descriptorQueue.add(response); + } if ((!this.missingConsensus || (this.downloadConsensusFromAllAuthorities && this.requestedConsensuses.containsAll( this.directoryAuthorities.keySet()))) && this.missingVotes.isEmpty() && this.requestingVotes.isEmpty()) { + /* TODO This logic may be somewhat broken. We don't wait for all + * consensus requests to complete or fail, which results in adding + * (failed) requests to the queue when we think we're done. */ this.hasFinishedDownloading = true; this.globalTimerThread.interrupt(); this.descriptorQueue.setOutOfDescriptors(); @@ -470,9 +475,10 @@ public class RelayDescriptorDownloaderImpl this.requestTimeout = requestTimeout; } public void run() { - DescriptorRequestImpl request = null; + boolean keepRunning = true; do { - request = this.downloadCoordinator.createRequest(this.nickname); + DescriptorRequestImpl request = + this.downloadCoordinator.createRequest(this.nickname); if (request != null) { String url = "http://" + this.ipPort + request.getRequestedResource(); @@ -503,16 +509,18 @@ public class RelayDescriptorDownloaderImpl request.setRequestEnd(System.currentTimeMillis()); } } catch (IOException e) { - /* TODO Should we print out a warning or something? */ - e.printStackTrace(); - break; + /* Stop downloading from this directory if there are any + * problems, e.g., refused connections. */ + keepRunning = false; } /* TODO How do we find out if we were interrupted, and by who? * Set the request or global timeout flag in the response. */ timeoutThread.interrupt(); this.downloadCoordinator.deliverResponse(request); + } else { + keepRunning = false; } - } while (request != null); + } while (keepRunning); } }

1 0

[metrics-lib/master] Fix typos.
by karsten＠torproject.org 10 Jan '12

10 Jan '12

commit 6f5515aae7d31ed47664291e08ccf609a67868a9 Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Tue Jan 10 10:15:55 2012 +0100 Fix typos. --- .../descriptor/impl/BlockingIteratorImpl.java | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/org/torproject/descriptor/impl/BlockingIteratorImpl.java b/src/org/torproject/descriptor/impl/BlockingIteratorImpl.java index 195acfe..a26c4fb 100644 --- a/src/org/torproject/descriptor/impl/BlockingIteratorImpl.java +++ b/src/org/torproject/descriptor/impl/BlockingIteratorImpl.java @@ -22,7 +22,7 @@ public class BlockingIteratorImpl<T> implements Iterator<T> { /* Add an object to the queue. */ protected synchronized void add(T object) { if (this.outOfDescriptors) { - throw new IllegalStateException("Internal erorr: Adding results to " + throw new IllegalStateException("Internal error: Adding results to " + "descriptor queue not allowed after sending end-of-stream " + "object."); } @@ -34,7 +34,7 @@ public class BlockingIteratorImpl<T> implements Iterator<T> { private boolean outOfDescriptors = false; protected synchronized void setOutOfDescriptors() { if (this.outOfDescriptors) { - throw new IllegalStateException("Internal erorr: Sending " + throw new IllegalStateException("Internal error: Sending " + "end-of-stream object only permitted once."); } this.outOfDescriptors = true;

1 0

[tor/master] Remove (untriggerable) overflow in crypto_random_hostname()
by nickm＠torproject.org 10 Jan '12

10 Jan '12

commit 3fadc074caa2f69b9d4ef17339a42dc9fbe4ad9e Author: Stephen Palmateer <stephen.palmateer(a)gmail.com> Date: Wed Dec 21 12:48:38 2011 -0500 Remove (untriggerable) overflow in crypto_random_hostname() Fixes bug 4413; bugfix on xxxx. Hostname components cannot be larger than 63 characters. This simple check makes certain randlen cannot overflow rand_bytes_len. --- changes/bug4413 | 2 ++ src/common/crypto.c | 8 ++++++++ 2 files changed, 10 insertions(+), 0 deletions(-) diff --git a/changes/bug4413 b/changes/bug4413 new file mode 100644 index 0000000..653ddeb --- /dev/null +++ b/changes/bug4413 @@ -0,0 +1,2 @@ +Minor bugfixes: + - Check for a potential, however unlikely, integer overflow. Fixes bug 4413; Bugfix on 0.2.3.9-alpha. diff --git a/src/common/crypto.c b/src/common/crypto.c index 673fc0c..9ee3d98 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -82,6 +82,9 @@ #include "sha256.c" #define SHA256_Final(a,b) sha256_done(b,a) +/* Bug 4413*/ +#define MAX_HOSTNAME_SIZE 63 + static unsigned char * SHA256(const unsigned char *m, size_t len, unsigned char *d) { @@ -2554,7 +2557,12 @@ crypto_random_hostname(int min_rand_len, int max_rand_len, const char *prefix, size_t resultlen, prefixlen; tor_assert(max_rand_len >= min_rand_len); + randlen = min_rand_len + crypto_rand_int(max_rand_len - min_rand_len + 1); + if (randlen > MAX_HOSTNAME_SIZE) { + randlen = MAX_HOSTNAME_SIZE; + } + prefixlen = strlen(prefix); resultlen = prefixlen + strlen(suffix) + randlen + 16;

1 0

[tor/master] Tweaks for bug4413 fix
by nickm＠torproject.org 10 Jan '12

10 Jan '12

commit b1ee1a719db0a47fa27a8efd9a6e7e443dca2550 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jan 9 19:14:51 2012 -0500 Tweaks for bug4413 fix The thing that's limited to 63 bytes is a "label", not a hostname. Docment input constraints and behavior on bogus inputs. Generally it's better to check for overflow-like conditions before than after. In this case, it's not a true overflow, so we're okay, but let's be consistent. pedantic less->fewer in the documentation --- src/common/crypto.c | 19 +++++++++++-------- 1 files changed, 11 insertions(+), 8 deletions(-) diff --git a/src/common/crypto.c b/src/common/crypto.c index 9ee3d98..7edc7f2 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -82,8 +82,8 @@ #include "sha256.c" #define SHA256_Final(a,b) sha256_done(b,a) -/* Bug 4413*/ -#define MAX_HOSTNAME_SIZE 63 +/** Longest recognized */ +#define MAX_DNS_LABEL_SIZE 63 static unsigned char * SHA256(const unsigned char *m, size_t len, unsigned char *d) @@ -2545,9 +2545,12 @@ crypto_rand_double(void) } /** Generate and return a new random hostname starting with prefix, - * ending with suffix, and containing no less than + * ending with suffix, and containing no fewer than * min_rand_len and no more than max_rand_len random base32 - * characters between. */ + * characters between. + * + * Clip max_rand_len to MAX_DNS_LABEL_SIZE. + **/ char * crypto_random_hostname(int min_rand_len, int max_rand_len, const char *prefix, const char *suffix) @@ -2556,12 +2559,12 @@ crypto_random_hostname(int min_rand_len, int max_rand_len, const char *prefix, int randlen, rand_bytes_len; size_t resultlen, prefixlen; - tor_assert(max_rand_len >= min_rand_len); + if (max_rand_len > MAX_DNS_LABEL_SIZE) + max_rand_len = MAX_DNS_LABEL_SIZE; + if (min_rand_len > max_rand_len) + min_rand_len = max_rand_len; randlen = min_rand_len + crypto_rand_int(max_rand_len - min_rand_len + 1); - if (randlen > MAX_HOSTNAME_SIZE) { - randlen = MAX_HOSTNAME_SIZE; - } prefixlen = strlen(prefix); resultlen = prefixlen + strlen(suffix) + randlen + 16;

1 0

[tor/master] Revise bug4413 changes file
by nickm＠torproject.org 10 Jan '12

10 Jan '12

commit 489db38229074e3d31d65ac9e60407ddb4826789 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jan 9 19:18:48 2012 -0500 Revise bug4413 changes file --- changes/bug4413 | 7 +++++-- 1 files changed, 5 insertions(+), 2 deletions(-) diff --git a/changes/bug4413 b/changes/bug4413 index 653ddeb..673e28f 100644 --- a/changes/bug4413 +++ b/changes/bug4413 @@ -1,2 +1,5 @@ -Minor bugfixes: - - Check for a potential, however unlikely, integer overflow. Fixes bug 4413; Bugfix on 0.2.3.9-alpha. + o Minor bugfixes: + - Fix our implementation of crypto_random_hostname() so it can't + overflow on ridiculously large inputs. (No Tor version has ever + provided this kind of bad inputs, but let's be correct in depth.) + Fixes bug 4413; bugfix on 0.2.2.9-alpha. Fix by Stephen Palmateer.

1 0

[torspec/master] Update proposals 189, 190 and 191.
by nickm＠torproject.org 09 Jan '12

09 Jan '12

commit af99cd5ada63d7afcc09f7912a1686a5b62ebe62 Author: George Kadianakis <desnacked(a)gmail.com> Date: Sun Jan 8 02:02:12 2012 +0100 Update proposals 189, 190 and 191. --- proposals/189-authorize-cell.txt | 34 ++++- proposals/190-password-bridge-authorization.txt | 153 +++++++------------- proposals/191-mitm-bridge-detection-resistance.txt | 59 +++++++- 3 files changed, 129 insertions(+), 117 deletions(-) diff --git a/proposals/189-authorize-cell.txt b/proposals/189-authorize-cell.txt index 10b45a2..09f74e6 100644 --- a/proposals/189-authorize-cell.txt +++ b/proposals/189-authorize-cell.txt @@ -62,6 +62,8 @@ Status: Open a meta-field hosting an arbitrary amount of fields. 'PadLen', specifies the amount of padding in octets. + Implementations SHOULD pick 'PadLen' to be a random integer from 1 + to 3141 inclusive. 'Padding', is 'PadLen' octets of random content. @@ -89,27 +91,33 @@ Status: Open 4. Discussion -4.1. Why not let the pluggable transports do the padding, like they +4.1. What's up with the [1,3141] padding bytes range? + + The upper limit is larger than the Ethernet MTU so that AUTHORIZE + and AUTHORIZED cells are not always transmitted into a single + packet. Other than that, it's indeed pretty much arbitrary. + +4.2. Why not let the pluggable transports do the padding, like they are supposed to do for the rest of the Tor protocol? The arguments of section "Alternative design: Just use pluggable transports" of proposal 187, apply here as well: - All bridges who use client authorization will also need camouflaged - AUTHORIZE/AUTHORIZED cell. + All bridges who use client authorization will also need padded + AUTHORIZE and AUTHORIZED cells. -4.2. How should multiple round-trip authorization protocols be handled? +4.3. How should multiple round-trip authorization protocols be handled? - Protocols that require multiple round-trips between the client and + Protocols that require multiple-round trips between the client and the bridge should use AUTHORIZE cells for communication. The format of the AUTHORIZE cell is flexible enough to support - messages from the client to the bridge and the inverse. + messages from the client to the bridge and the reverse. - In the end of a successful multiple round-trip protocol, an + At the end of a successful multiple round-trip protocol, an AUTHORIZED cell must be issued from the bridge to the client. -4.3. AUTHORIZED seems useless. Why not use VPADDING instead? +4.4. AUTHORIZED seems useless. Why not use VPADDING instead? As noted in proposal 187, the Tor protocol uses VPADDING cells for padding; any other use of VPADDING makes the Tor protocol kludgy. @@ -120,3 +128,13 @@ Status: Open bridge, in the case of successful authorization, to also process the VERSIONS cell and begin the v3 handshake promptly. +4.5. What should actually happen when a bridge rejects an AUTHORIZE + cell? + + When a bridge detects a badly formed or malicious AUTHORIZE cell, + it should assume that the other side is an adversary scanning for + bridges. The bridge should then act accordingly to avoid detection. + + This proposal does not try to specify how a bridge can avoid + detection by an adversary. + diff --git a/proposals/190-password-bridge-authorization.txt b/proposals/190-password-bridge-authorization.txt index 36c8c35..95a0d19 100644 --- a/proposals/190-password-bridge-authorization.txt +++ b/proposals/190-password-bridge-authorization.txt @@ -1,145 +1,90 @@ -Filename: 190-password-bridge-authorization.txt -Title: Password-based Bridge Client Authorization +Filename: 190-shared-secret-bridge-authorization.txt +Title: Bridge Client Authorization Based on a Shared Secret Author: George Kadianakis Created: 04 Nov 2011 Status: Open 1. Overview - Proposals 187 and 189 introduced the AUTHORIZE and AUTHORIZED cells. + Proposals 187 and 189 introduced AUTHORIZE and AUTHORIZED cells. Their purpose is to make bridge relays scanning resistant against censoring adversaries capable of probing hosts to observe whether they speak the Tor protocol. This proposal specifies a bridge client authorization scheme based - on a shared password between the bridge user and bridge operator. + on a shared secret between the bridge user and bridge operator. 2. Motivation - A proper bridge client authorization scheme should: + A bridge client authorization scheme should only allow clients who + show knowledge of a shared secret to talk Tor to the bridge. - - request information from a client that only an authorized bridge - client would know. +3. Shared-secret-based authorization - - ensure that the shared secret sent by the bridge client during - the authorization can only be read and validated by the proper - bridge relay. This is important since the v3 link handshake which - authenticates the bridge to the client is carried out *after* the - bridge client authorization, which means that when the AUTHORIZE - cell is sent, the client might be actually speaking to a Man In - The Middle. +3.1. Where do shared secrets come from? - The bridge client authorization scheme presented in this proposal - is based on a shared password and attempts to satisfy both of the - above requirements. + A shared secret is a piece of data known only to the bridge + operator and the bridge client. -3. Design + It's meant to be automatically generated by the bridge + implementation to avoid issues with insecure and weak passwords. - If the AuthMethod of an AUTHORIZE cell is '0x1', the client wants - to become authorized using a shared secret based on a password. + Bridge implementations SHOULD create shared secrets by generating + random data using a strong RNG or PRNG. - The short name of this authorization scheme is 'BRIDGE_AUTH_PSK'. +3.2. AUTHORIZE cell format -3.1. Notation - - '||', denotes concatenation. - - 'HMAC(k, m)', is the Hash-based Message Authentication Code of - message 'm' using 'k' as the secret key. - - 'H(m)', is a cryptographic hash function applied on a message 'm'. - - 'HASH_LEN', is the output size of the hash function 'H'. - -3.2. Shared secret format - - A bridge client and a bridge relay willing to use this - authorization scheme, should have already exchanged out-of-band - (for example, during the bridge credentials exchange) a shared - password. - - In this case, the shared secret of this scheme becomes: - - shared_secret = H( H(bridge_identity_key) || ":" || password) - - where: - - 'bridge_identity_key', is the PKCS#1 ASN1 encoding of the bridge's - public identity key. - - '":"', is the colon character (0x3a in UTF-8). - - 'password', is the bridge password. - -3.3. Password-based authorization AUTHORIZE cell format - - In password-based authorization, the MethodFields field of the + In shared-secret-based authorization, the MethodFields field of the AUTHORIZE cell becomes: - 'HMAC(shared_secret, tls_cert)' [HASH_LEN octets] + 'shared_secret' [10 octets] where: - 'HMAC(shared_secret, tls_cert), is the HMAC construction of the TLS - certificate of the bridge relay, using the shared secret of section - 3.2 as the secret key. + 'shared_secret', is the shared secret between the bridge operator + and the bridge client. -3.4. Password-based authorization notes +3.3. Cell parsing - Bridge implementations MUST reject clients who provide malformed - AUTHORIZE cells or HMAC values that do not verify the appropriate - TLS certificate. + Bridge implementations MUST reject any AUTHORIZE cells whose + 'shared_secret' field does not match the shared secret negotiated + between the bridge operator and authorized bridge clients. - Bridge implementations SHOULD provide an easy way to create and - change the bridge shared secret. +4. Tor implementation -3.5. Security arguments +4.1. Bridge side - An adversary who does not know the 'shared_secret' of a bridge - cannot construct an HMAC that verifies its TLS certificate when - used with the correct 'shared_secret'. + Tor bridge implementations MUST create the bridge shared secret by + generating 10 octets of random data using a strong RNG or PRNG. - An adversary who attempts to MITM the TLS connection of a bridge - user to steal the 'shared_secret' will instead steal an HMAC value - created by the 'tls_cert' of the TLS certificate that the attacker - used to MITM the TLS connection. Replaying that 'shared_secret' - value to the actual bridge will fail to verify the correct - 'tls_cert'. + Tor bridge implementations MUST store the shared secret in + 'DataDirectory/keys/bridge_auth_ss_key' in hexademical encoding. - The two above paragraphs resolve the requirements of the - 'Motivation' section. + Tor bridge implementations MUST support the boolean + 'BridgeRequireClientSharedSecretAuthorization' configuration file + option which enables bridge client authorization based on a shared + secret. - Furthermore, an adversary who compromises a bridge, steals the - shared secret and attempts to replay it to other bridges of the - same bridge operator will fail since each shared secret has a - digest of the bridge's identity key baked in it. + If 'BridgeRequireClientSharedSecretAuthorization' is set, bridge + implementations MUST generate a new shared secret, if + 'DataDirectory/keys/bridge_auth_ss_key' does not already exist. - The bridge's identity key digest also serves as a salt to counter - rainbow table precomputation attacks. +4.2. Client side -4. Tor implementation + Tor client implementations must extend their Bridge line format to + support bridge shared secrets. The new format is: + Bridge <method> <address:port> [["keyid="]<id-fingerprint>] ["shared_secret="<shared_secret>] - The Tor implementation of the above scheme uses SHA256 as the hash - function 'H'. + where <shared_secret> is the bridge shared secret in hexademical + encoding. - SHA256 also makes HASH_LEN equal to 32. + Tor clients who use bridges with shared-secret-based client + authorization must specify the bridge's shared secret as in: + Bridge 12.34.56.78 shared_secret=934caff420aa7852b855 5. Discussion -5.1. Do we need more authorization schemes? - - Probably yes. - - The centuries-old problem with passwords is that humans can't get - their passwords right. - - To avoid problems associated with the human condition, schemes - based on public key cryptography and certificates can be used. A - public and well tested protocol that can be used as the basis of a - future authorization scheme is the SSH "publickey" authorization - protocol. - -5.2. What should actually happen when a bridge rejects an AUTHORIZE +5.1. What should actually happen when a bridge rejects an AUTHORIZE cell? When a bridge detects a badly formed or malicious AUTHORIZE cell, @@ -151,6 +96,6 @@ Status: Open 6. Acknowledgements - Without Nick Mathewson and Robert Ransom this proposal would - actually be specifying a useless and broken authentication scheme. - Thanks! + Thanks to Nick Mathewson and Robert Ransom for the help and + suggestions while writing this proposal. + diff --git a/proposals/191-mitm-bridge-detection-resistance.txt b/proposals/191-mitm-bridge-detection-resistance.txt index 7709ae8..013d76c 100644 --- a/proposals/191-mitm-bridge-detection-resistance.txt +++ b/proposals/191-mitm-bridge-detection-resistance.txt @@ -68,7 +68,9 @@ Status: Open The certificate fingerprints used on this scheme MUST be computed by applying the SHA256 cryptographic hash function upon the ASN.1 - DER encoding of a public-key certificate. + DER encoding of a public-key certificate, then truncating the hash + output to 12 bytes, encoding it to RFC4648 Base32 and omitting any + trailing padding '='. 4.2. Bridge side implementation @@ -90,13 +92,12 @@ Status: Open Bridge <method> <address:port> [["keyid="]<id-fingerprint>] \ ["shared_secret="<shared_secret>] ["link_cert_fpr="<fingerprint>] - where <fingerprint> is the bridge's SSL certificate fingerprint in - hexademical encoding. + where <fingerprint> is the bridge's SSL certificate fingerprint. Tor clients who use bridges and want to pin their SSL certificates must specify the bridge's SSL certificate fingerprint as in: Bridge 12.34.56.78 shared_secret=934caff420aa7852b855 \ - link_cert_fpr=38b0712e90bed729df81f2a22811d3dd89e91406d2522f4482ae4079e5245187 + link_cert_fpr=GM4GEMBXGEZGKOJQMJSWINZSHFSGMOBRMYZGCMQ 4.4. Implementation prerequisites @@ -107,7 +108,55 @@ Status: Open Tor trac ticket #4390 and proposal YYY were created to resolve this issue. -5. Acknowledgements +5. Other ideas + +5.1. Certificate tagging using a shared secret + + Another idea worth considering is having the bridge use the shared + secret from proposal 190 to embed a "secret message" on her + certificate, which could only be understood by a client who knows + that shared secret, essentially authenticating the bridge. + + Specifically, the bridge would "tag" the Serial Number (or any + other covert field) of her certificate with the (potentially + truncated) HMAC of her link public key, using the shared secret of + proposal 190 as the key: HMAC(shared_secret, link_public_key). + + A client knowing the shared secret would be able to verify the + 'link_public_key' and authenticate the bridge, and since the Serial + Number field is usually composed of random bytes a probing attacker + would not notice the "tagging" of the certificate. + + Arguments for this scheme are that it: + a) doesn't need extra bridge credentials apart from the shared secret + of prop190. + b) doesn't need any maintenance in case of certificate expiration. + + Arguments against this scheme are: + a) In the case of self-signed certificates, OpenSSL creates an + 8-bytes random Serial number, and we would probably need + something more than 8-bytes to tag. There are not many other + covert fields in SSL certificates mutable by vanilla OpenSSL. + b) It complicates the scheme, and if not implemented and researched + wisely it might also make it fingerprintable. + c) We most probably won't be able to tag CA-signed certificates. + +6. Discussion + +6.1. In section 4.1, why do you truncate the SHA256 output to 12 bytes?! + + Bridge credentials are frequently propagated by word of mouth or + are physically written down, which renders the occult Base64 + encoding unsatisfactory. The 104 characters Base32 encoding or the + 64 characters hex representation of the SHA256 output would also be + too much bloat. + + By truncating the SHA256 output to 12 bytes and encoding it with + Base32, we get 39 characters of readable and easy to transcribe + output, and sufficient security. Finally, dividing '39' by the + golden ratio gives us about 24.10! + +7. Acknowledgements Thanks to Robert Ransom for his great help and suggestions on devising this scheme and writing this proposal!

1 0

[translation/tsum] Update translations for tsum
by translation＠torproject.org 09 Jan '12

09 Jan '12

commit f856be013711ed61fcc0f577f1722971508f70ff Author: Translation commit bot <translation(a)torproject.org> Date: Mon Jan 9 22:15:04 2012 +0000 Update translations for tsum --- pl/tsum.po | 19 ++++++++++++++++++- 1 files changed, 18 insertions(+), 1 deletions(-) diff --git a/pl/tsum.po b/pl/tsum.po index 306ee89..a5a1ba3 100644 --- a/pl/tsum.po +++ b/pl/tsum.po @@ -9,7 +9,7 @@ msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: https://trac.torproject.org/projects/tor\n" "POT-Creation-Date: 2011-11-05 17:16+0000\n" -"PO-Revision-Date: 2012-01-09 21:43+0000\n" +"PO-Revision-Date: 2012-01-09 21:57+0000\n" "Last-Translator: jan kowalski <janfkowalski(a)gmail.com>\n" "Language-Team: LANGUAGE <LL(a)li.org>\n" "MIME-Version: 1.0\n" @@ -47,6 +47,8 @@ msgid "" "How Tor works\n" "-------------\n" msgstr "" +"Jak działa Tor\n" +"-------------\n" #. type: Plain text #: en/tsum.text:19 @@ -82,6 +84,9 @@ msgid "" "traffic inside the Tor network, but it cannot encrypt your traffic between " "the Tor network and its final destination." msgstr "" +"Tor ukryje pochodzenie Twojego zapytania, oraz zaszyfruje Twoje zapytania " +"wewnątrz sieci Tor, ale nie zaszyfruje Twoich zapytań pomiędzy siecią Tor a " +"jakoś tak." #. type: Plain text #: en/tsum.text:36 @@ -98,6 +103,8 @@ msgid "" "How to download Tor\n" "-------------------\n" msgstr "" +"Jak pobrać Tor\n" +"-------------------\n" #. type: Plain text #: en/tsum.text:44 @@ -282,6 +289,7 @@ msgid "" "To verify the signature of the package you downloaded, run the following " "command:" msgstr "" +"W celu weryfikacji podpisu pobranego pakietu, uruchom poniższą komendę:" #. type: Plain text #: en/tsum.text:134 @@ -290,6 +298,8 @@ msgid "" "\tgpg --verify tor-browser-2.2.33-2_en-US.exe.asc tor-browser-2.2.33-2_en-" "US.exe\n" msgstr "" +"»gpg --verify tor-browser-2.2.33-2_en-US.exe.asc tor-browser-2.2.33-2_en-" +"US.exe\n" #. type: Plain text #: en/tsum.text:140 @@ -488,6 +498,11 @@ msgid "" "3. Click on the *View* tab\n" "4. Uncheck *Hide extensions for known file types* and click *OK*" msgstr "" +"#### Windows XP\n" +"1. Otwórz *Mój Komputer*\n" +"2. Kliknij *Narzędzia* i wybierz *Opcje Folderów...* w menu\n" +"3. Klinkij *Widok* tab\n" +"4. Odznacz *Ukryj rozszerzenia znanych typów plików* i kliknij *OK*" #. type: Plain text #: en/tsum.text:260 @@ -605,5 +620,7 @@ msgid "" "### Why Tor is slow\n" "Tor can sometimes be a bit slower than your normal Internet connection. After all, your traffic is sent through many different countries, sometimes across oceans around the world!" msgstr "" +"### Why Tor is slow\n" +"Tor can sometimes be a bit slower than your normal Internet connection. After all, your traffic is sent through many different countries, sometimes across oceans around the world!"

1 0

[translation/tsum] Update translations for tsum
by translation＠torproject.org 09 Jan '12

09 Jan '12

commit 7731f9ccb0efb391795446071abd845e0a9d44a6 Author: Translation commit bot <translation(a)torproject.org> Date: Mon Jan 9 21:45:04 2012 +0000 Update translations for tsum --- pl/tsum.po | 609 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 609 insertions(+), 0 deletions(-) diff --git a/pl/tsum.po b/pl/tsum.po new file mode 100644 index 0000000..306ee89 --- /dev/null +++ b/pl/tsum.po @@ -0,0 +1,609 @@ +# SOME DESCRIPTIVE TITLE +# Copyright (C) YEAR The Tor Project, Inc +# This file is distributed under the same license as the PACKAGE package. +# +# Translators: +# jan kowalski <janfkowalski(a)gmail.com>, 2012. +msgid "" +msgstr "" +"Project-Id-Version: The Tor Project\n" +"Report-Msgid-Bugs-To: https://trac.torproject.org/projects/tor\n" +"POT-Creation-Date: 2011-11-05 17:16+0000\n" +"PO-Revision-Date: 2012-01-09 21:43+0000\n" +"Last-Translator: jan kowalski <janfkowalski(a)gmail.com>\n" +"Language-Team: LANGUAGE <LL(a)li.org>\n" +"MIME-Version: 1.0\n" +"Content-Type: text/plain; charset=UTF-8\n" +"Content-Transfer-Encoding: 8bit\n" +"Language: pl\n" +"Plural-Forms: nplurals=3; plural=(n==1 ? 0 : n%10>=2 && n%10<=4 && (n%100<10 || n%100>=20) ? 1 : 2)\n" + +#. type: Plain text +#: en/tsum.text:2 +msgid "# The Short User Manual\n" +msgstr "" + +#. type: Plain text +#: en/tsum.text:7 +msgid "" +"This user manual contains information about how to download Tor, how to use " +"it, and what to do if Tor is unable to connect to the network. If you can't " +"find the answer to your question in this document, email " +"help(a)rt.torproject.org." +msgstr "" + +#. type: Plain text +#: en/tsum.text:11 +msgid "" +"Please note that we are providing support on a voluntary basis, and we get a" +" lot of emails every single day. There is no need to worry if we don't get " +"back to you straight away." +msgstr "" + +#. type: Plain text +#: en/tsum.text:13 +#, no-wrap +msgid "" +"How Tor works\n" +"-------------\n" +msgstr "" + +#. type: Plain text +#: en/tsum.text:19 +msgid "" +"Tor is a network of virtual tunnels that allows you to improve your privacy " +"and security on the Internet. Tor works by sending your traffic through " +"three random servers (also known as *relays*) in the Tor network, before the" +" traffic is sent out onto the public Internet." +msgstr "" +"Tor jest siecią wirtualnych tuneli, które poprawiają Twoją prywatność i " +"bezpieczeństwo w Internecie. Tor działa poprzez wysyłanie Twoich zapytań " +"przez trzy losowo wybrane serwery (także nane jako *relays*) w sieci Tor, " +"zanim zostaną wysłane do publicznego Internetu." + +#. type: Plain text +#: en/tsum.text:21 +msgid "![How Tor Works](images/how-tor-works.png)" +msgstr "![Jak działa Tor](images/how-tor-works.png)" + +#. type: Plain text +#: en/tsum.text:26 +msgid "" +"The image above illustrates a user browsing to different websites over Tor. " +"The green monitors represent relays in the Tor network, while the three keys" +" represent the layers of encryption between the user and each relay." +msgstr "" + +#. type: Plain text +#: en/tsum.text:31 +msgid "" +"Tor will anonymize the origin of your traffic, and it will encrypt " +"everything between you and the Tor network. Tor will also encrypt your " +"traffic inside the Tor network, but it cannot encrypt your traffic between " +"the Tor network and its final destination." +msgstr "" + +#. type: Plain text +#: en/tsum.text:36 +msgid "" +"If you are communicating sensitive information, for example when logging on " +"to a website with a username and password, make sure that you are using " +"HTTPS (e.g. **https**://torproject.org/, not **http**://torproject.org/)." +msgstr "" + +#. type: Plain text +#: en/tsum.text:38 +#, no-wrap +msgid "" +"How to download Tor\n" +"-------------------\n" +msgstr "" + +#. type: Plain text +#: en/tsum.text:44 +msgid "" +"The bundle we recommend to most users is the [Tor Browser " +"Bundle](https://www.torproject.org/projects/torbrowser.html). This bundle " +"contains a browser preconfigured to safely browse the Internet through Tor, " +"and requires no installation. You download the bundle, extract the archive, " +"and start Tor." +msgstr "" + +#. type: Plain text +#: en/tsum.text:48 +msgid "" +"There are two different ways to get hold of the Tor software. You can either" +" browse to the [Tor Project website](https://www.torproject.org/) and " +"download it there, or you can use GetTor, the email autoresponder." +msgstr "" + +#. type: Plain text +#: en/tsum.text:53 +msgid "" +"### How to get Tor via email\n" +"To receive the English Tor Browser Bundle for Windows, send an email to gettor(a)torproject.org with **windows** in the body of the message. You can leave the subject blank." +msgstr "" + +#. type: Plain text +#: en/tsum.text:57 +msgid "" +"You can also request the Tor Browser Bundle for Mac OS X (write " +"**macos-i386**), and Linux (write **linux-i386** for 32-bit systems or " +"**linux-x86_64** for 64-bit systems)." +msgstr "" + +#. type: Plain text +#: en/tsum.text:61 +msgid "" +"If you want a translated version of Tor, write **help** instead. You will " +"then receive an email with instructions and a list of available languages." +msgstr "" + +#. type: Plain text +#: en/tsum.text:67 +#, no-wrap +msgid "" +"**Note**: The Tor Browser Bundles for Linux and Mac OS X are rather\n" +"large, and you will not be able to receive any of these bundles with a\n" +"Gmail, Hotmail or Yahoo account. If you cannot receive the bundle you\n" +"want, send an email to help(a)rt.torproject.org and we\n" +"will give you a list of website mirrors to use.\n" +msgstr "" + +#. type: Plain text +#: en/tsum.text:73 +msgid "" +"#### How to get Tor as several small sized packages\n" +"It is possible to request the Tor Browser Bundle for Windows as several small sized packages, instead of one big package. This can be useful if you don't have a lot of bandwidth available, or if your email provider does not allow you to receive large attachments." +msgstr "" + +#. type: Plain text +#: en/tsum.text:76 +msgid "" +"Send an email to gettor(a)torproject.org with the following words in the body " +"of the email:" +msgstr "" + +#. type: Plain text +#: en/tsum.text:79 +#, no-wrap +msgid "" +"windows \n" +"split\n" +msgstr "" + +#. type: Plain text +#: en/tsum.text:83 +msgid "" +"It is important that you include the keyword *split* on its own line. See " +"*What to do with split packages* for information on how to unpack and re-" +"assemble the small sized packages." +msgstr "" + +#. type: Plain text +#: en/tsum.text:89 +msgid "" +"### Tor for smartphones\n" +"You can get Tor on your Android device by installing the package named *Orbot*. For information about how to download and install Orbot, please see the [Tor Project website](https://www.torproject.org/docs/android.html.en)." +msgstr "" + +#. type: Plain text +#: en/tsum.text:93 +msgid "" +"We also have experimental packages for [Nokia " +"Maemo/N900](https://www.torproject.org/docs/N900.html.en) and [Apple " +"iOS](http://sid77.slackware.it/iphone/)." +msgstr "" + +#. type: Plain text +#: en/tsum.text:97 +msgid "" +"### How to verify that you have the right version\n" +"Before running the Tor Browser Bundle, you should make sure that you have the right version." +msgstr "" + +#. type: Plain text +#: en/tsum.text:102 +msgid "" +"The software you receive is accompanied by a file with the same name as the " +"bundle and the extension **.asc**. This .asc file is a GPG signature, and " +"will allow you to verify the file you've downloaded is exactly the one that " +"we intended you to get." +msgstr "" + +#. type: Plain text +#: en/tsum.text:105 +#, no-wrap +msgid "" +"Before you can verify the signature, you will have to download and\n" +"install GnuPG: \n" +msgstr "" + +#. type: Plain text +#: en/tsum.text:109 +#, no-wrap +msgid "" +"**Windows**: [http://gpg4win.org/download.html](http://gpg4win.org/download.html) \n" +"**Mac OS X**: [http://macgpg.sourceforge.net/](http://macgpg.sourceforge.net/) \n" +"**Linux**: Most Linux distributions come with GnuPG preinstalled.\n" +msgstr "" + +#. type: Plain text +#: en/tsum.text:112 +msgid "" +"Please note that you may need to edit the paths and the commands used below " +"to get it to work on your system." +msgstr "" + +#. type: Plain text +#: en/tsum.text:115 +msgid "" +"Erinn Clark signs the Tor Browser Bundles with key 0x63FEE659. To import " +"Erinn's key, run:" +msgstr "" + +#. type: Plain text +#: en/tsum.text:117 +#, no-wrap +msgid "\tgpg --keyserver hkp://keys.gnupg.net --recv-keys 0x63FEE659\n" +msgstr "" + +#. type: Plain text +#: en/tsum.text:119 +msgid "After importing the key, verify that the fingerprint is correct:" +msgstr "" + +#. type: Plain text +#: en/tsum.text:121 +#, no-wrap +msgid "\tgpg --fingerprint 0x63FEE659\n" +msgstr "" + +#. type: Plain text +#: en/tsum.text:123 +msgid "You should see:" +msgstr "" + +#. type: Plain text +#: en/tsum.text:130 +#, no-wrap +msgid "" +"\tpub 2048R/63FEE659 2003-10-16\n" +"\t Key fingerprint = 8738 A680 B84B 3031 A630 F2DB 416F 0610 63FE E659\n" +"\tuid Erinn Clark <erinn(a)torproject.org>\n" +"\tuid Erinn Clark <erinn(a)debian.org>\n" +"\tuid Erinn Clark <erinn(a)double-helix.org>\n" +"\tsub 2048R/EB399FD7 2003-10-16\n" +msgstr "" + +#. type: Plain text +#: en/tsum.text:132 +msgid "" +"To verify the signature of the package you downloaded, run the following " +"command:" +msgstr "" + +#. type: Plain text +#: en/tsum.text:134 +#, no-wrap +msgid "" +"\tgpg --verify tor-browser-2.2.33-2_en-US.exe.asc tor-browser-2.2.33-2_en-" +"US.exe\n" +msgstr "" + +#. type: Plain text +#: en/tsum.text:140 +msgid "" +"The output should say *\"Good signature\"*. A bad signature means that the " +"file may have been tampered with. If you see a bad signature, send details " +"about where you downloaded the package from, how you verified the signature," +" and the output from GnuPG in an email to help(a)rt.torproject.org." +msgstr "" + +#. type: Plain text +#: en/tsum.text:147 +msgid "" +"Once you have verified the signature and seen the *\"Good signature\"* " +"output, go ahead and extract the package archive. You should then see a " +"directory similar to **tor-browser_en-US**. Inside that directory is another" +" directory called **Docs**, which contains a file called **changelog**. You " +"want to make sure that the version number on the top line of the changelog " +"file matches the version number in the filename." +msgstr "" + +#. type: Plain text +#: en/tsum.text:153 +msgid "" +"### How to use the Tor Browser Bundle\n" +"After downloading the Tor Browser Bundle and extracting the package, you should have a directory with a few files in it. One of the files is an executable called \"Start Tor Browser\" (or \"start-tor-browser\", depending on your operating system)." +msgstr "" + +#. type: Plain text +#: en/tsum.text:160 +msgid "" +"When you start the Tor Browser Bundle, you will first see Vidalia start up " +"and connect you to the Tor network. After that, you will see a browser " +"confirming that you are now using Tor. This is done by displaying " +"[https://check.torproject.org/](https://check.torproject.org/). You can now " +"browse the Internet through Tor." +msgstr "" + +#. type: Plain text +#: en/tsum.text:163 +#, no-wrap +msgid "" +"*Please note that it is important that you use the browser that comes\n" +"with the bundle, and not your own browser.*\n" +msgstr "" + +#. type: Plain text +#: en/tsum.text:169 +msgid "" +"### What to do when Tor does not connect\n" +"Some users will notice that Vidalia gets stuck when trying to connect to the Tor network. If this happens, make sure that you are connected to the Internet. If you need to connect to a proxy server, see *How to use an open proxy* below." +msgstr "" + +#. type: Plain text +#: en/tsum.text:174 +msgid "" +"If your normal Internet connection is working, but Tor still can't connect " +"to the network, try the following; open the Vidalia control panel, click on " +"*Message Log* and select the *Advanced* tab. It may be that Tor won't " +"connect because:" +msgstr "" + +#. type: Plain text +#: en/tsum.text:178 +#, no-wrap +msgid "" +"**Your system clock is off**: Make sure that the date and time on your\n" +"system is correct, and restart Tor. You may need to synchronize your\n" +"system clock with an Internet time server. \n" +msgstr "" + +#. type: Plain text +#: en/tsum.text:183 +#, no-wrap +msgid "" +"**You are behind a restrictive firewall**: To tell Tor to only try port\n" +"80 and port 443, open the Vidalia control panel, click on *Settings* and\n" +"*Network*, and tick the box that says *My firewall only lets me connect\n" +"to certain ports*. \n" +msgstr "" + +#. type: Plain text +#: en/tsum.text:187 +#, no-wrap +msgid "" +"**Your anti-virus program is blocking Tor**: Make sure that your\n" +"anti-virus program is not preventing Tor from making network\n" +"connections.\n" +msgstr "" + +#. type: Plain text +#: en/tsum.text:191 +msgid "" +"If Tor still doesn't work, it's likely that your Internet Service Provider " +"(ISP) is blocking Tor. Very often this can be worked around with **Tor " +"bridges**, hidden relays that aren't as easy to block." +msgstr "" + +#. type: Plain text +#: en/tsum.text:195 +msgid "" +"If you need help with figuring out why Tor can't connect, send an email to " +"help(a)rt.torproject.org and include the relevant parts from the log file." +msgstr "" + +#. type: Plain text +#: en/tsum.text:203 +msgid "" +"### How to find a bridge\n" +"To use a bridge, you will first have to locate one; you can either browse to [bridges.torproject.org](https://bridges.torproject.org/), or you can send an email to bridges(a)torproject.org. If you do send an email, please make sure that you write **get bridges** in the body of the email. Without this, you will not get a reply. Note that you need to send this email from either a gmail.com or a yahoo.com address." +msgstr "" + +#. type: Plain text +#: en/tsum.text:208 +msgid "" +"Configuring more than one bridge address will make your Tor connection more " +"stable, in case some of the bridges become unreachable. There is no " +"guarantee that the bridge you are using now will work tomorrow, so you " +"should make a habit of updating your list of bridges every so often." +msgstr "" + +#. type: Plain text +#: en/tsum.text:214 +msgid "" +"### How to use a bridge\n" +"Once you have a set of bridges to use, open the Vidalia control panel, click on *Settings*, *Network* and tick the box that says *My ISP blocks connections to the Tor network*. Enter the bridges in the box below, hit *OK* and start Tor again." +msgstr "" + +#. type: Plain text +#: en/tsum.text:220 +msgid "" +"### How to use an open proxy\n" +"If using a bridge does not work, try configuring Tor to use any HTTPS or SOCKS proxy to get access to the Tor network. This means even if Tor is blocked by your local network, open proxies can be safely used to connect to the Tor Network and on to the uncensored Internet." +msgstr "" + +#. type: Plain text +#: en/tsum.text:223 +msgid "" +"The steps below assume you have a functional Tor/Vidalia configuration, and " +"you have found a list of HTTPS, SOCKS4, or SOCKS5 proxies." +msgstr "" + +#. type: Bullet: '1. ' +#: en/tsum.text:235 +msgid "Open the Vidalia control panel, click on *Settings*." +msgstr "" + +#. type: Bullet: '2. ' +#: en/tsum.text:235 +msgid "Click *Network*. Select *I use a proxy to access the Internet*." +msgstr "" + +#. type: Plain text +#: en/tsum.text:235 +#, no-wrap +msgid "" +"3. On the *Address* line, enter the open proxy address. This can be a\n" +"hostname or an IP Address.\n" +"4. Enter the port for the proxy.\n" +"5. Generally, you do not need a username and password. If you do,\n" +"enter the information in the proper fields.\n" +"6. Choose the *Type* of proxy you are using, whether HTTP/HTTPS, SOCKS4,\n" +"or SOCKS5.\n" +"7. Push the *OK* button. Vidalia and Tor are now configured to use a\n" +"proxy to access the rest of the Tor network.\n" +msgstr "" + +#. type: Plain text +#: en/tsum.text:240 +msgid "" +"## Frequently Asked Questions\n" +"This section will answer some of the most common questions. If your question is not mentioned here, please send an email to help(a)rt.torproject.org." +msgstr "" + +#. type: Plain text +#: en/tsum.text:244 +msgid "" +"### Unable to extract the archive\n" +"If you are using Windows and find that you cannot extract the archive, download and install [7-Zip](http://www.7-zip.org/)." +msgstr "" + +#. type: Plain text +#: en/tsum.text:248 +msgid "" +"If you are unable to download 7-Zip, try to rename the file from .z to .zip " +"and use winzip to extract the archive. Before renaming the file, tell " +"Windows to show file extensions:" +msgstr "" + +#. type: Plain text +#: en/tsum.text:254 +msgid "" +"#### Windows XP\n" +"1. Open *My Computer*\n" +"2. Click on *Tools* and choose *Folder Options...* in the menu\n" +"3. Click on the *View* tab\n" +"4. Uncheck *Hide extensions for known file types* and click *OK*" +msgstr "" + +#. type: Plain text +#: en/tsum.text:260 +msgid "" +"#### Windows Vista\n" +"1. Open *Computer*\n" +"2. Click on *Organize* and choose *Folder and search options* in the menu\n" +"3. Click on the *View* tab\n" +"4. Uncheck *Hide extensions for known file types* and click *OK*" +msgstr "" + +#. type: Plain text +#: en/tsum.text:266 +msgid "" +"#### Windows 7\n" +"1. Open *Computer*\n" +"2. Click on *Organize* and choose *Folder and search options* in the menu\n" +"3. Click on the *View* tab\n" +" 4. Uncheck *Hide extensions for known file types* and click *OK*" +msgstr "" + +#. type: Plain text +#: en/tsum.text:273 +msgid "" +"### What to do with split packages\n" +"When you request a split package, the parts may arrive out of order. You need to make sure you have received all the parts before you attempt to unpack them. Save all the parts into one directory on your computer, unzip them, and double-click the file that ends in \"..split.part01.exe\" to start the unpacking process." +msgstr "" + +#. type: Plain text +#: en/tsum.text:277 +msgid "" +"Once the unpacking process has completed, you should see a newly created " +"\".exe\" file in the same directory. Run this file and wait for the Tor " +"Browser Bundle to start." +msgstr "" + +#. type: Plain text +#: en/tsum.text:281 +msgid "" +"### Vidalia asks for a password\n" +"You should not have to enter a password when starting Vidalia. If you are prompted for one, you are likely affected by one of these problems:" +msgstr "" + +#. type: Plain text +#: en/tsum.text:287 +#, no-wrap +msgid "" +"**You are already running Vidalia and Tor**:\n" +"For example, this situation can happen if you installed the Vidalia\n" +"bundle and now you're trying to run the Tor Browser Bundle. In that\n" +"case, you will need to close the old Vidalia and Tor before you can run\n" +"this one.\n" +msgstr "" + +#. type: Plain text +#: en/tsum.text:294 +#, no-wrap +msgid "" +"**Vidalia crashed, but left Tor running**:\n" +"If the dialog that prompts you for a control password has a Reset\n" +"button, you can click the button and Vidalia will restart Tor with a new\n" +"random control password. If you do not see a Reset button, or if Vidalia\n" +"is unable to restart Tor for you; go into your process or task manager,\n" +"and terminate the Tor process. Then use Vidalia to restart Tor.\n" +msgstr "" + +#. type: Plain text +#: en/tsum.text:298 +msgid "" +"For more information, see the " +"[FAQ](https://torproject.org/docs/faq.html#VidaliaPassword) on the Tor " +"Project website." +msgstr "" + +#. type: Plain text +#: en/tsum.text:303 +msgid "" +"### Flash does not work\n" +"For security reasons, Flash, Java, and other plugins are currently disabled for Tor. Plugins operate independently from Firefox and can perform activity on your computer that ruins your anonymity." +msgstr "" + +#. type: Plain text +#: en/tsum.text:308 +msgid "" +"Most YouTube videos work with HTML5, and it is possible to view these videos" +" over Tor. You need to join the [HTML5 trial](https://www.youtube.com/html5)" +" on the YouTube website before you can use the HTML5 player." +msgstr "" + +#. type: Plain text +#: en/tsum.text:312 +msgid "" +"Note that the browser will not remember that you joined the trial once you " +"close it, so you will need to re-join the trial the next time you run the " +"Tor Browser Bundle." +msgstr "" + +#. type: Plain text +#: en/tsum.text:315 +msgid "" +"Please see the [Torbutton FAQ](https://www.torproject.org/torbutton" +"/torbutton-faq.html#noflash) for more information." +msgstr "" + +#. type: Plain text +#: en/tsum.text:321 +msgid "" +"### I want to use another browser\n" +"For security reasons, we recommend that you only browse the web through Tor using the Tor Browser Bundle. It is technically possible to use Tor with other browsers, but by doing so you open yourself up to potential attacks." +msgstr "" + +#. type: Plain text +#: en/tsum.text:325 +msgid "" +"### Why Tor is slow\n" +"Tor can sometimes be a bit slower than your normal Internet connection. After all, your traffic is sent through many different countries, sometimes across oceans around the world!" +msgstr "" + +

1 0

[tor/master] Fix comment about TLSv1_method() per comments by wanoskarnet
by nickm＠torproject.org 09 Jan '12

09 Jan '12

commit c78a314e95ef7f0d05e9d58066ee6bf6795ee9d7 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jan 9 16:40:21 2012 -0500 Fix comment about TLSv1_method() per comments by wanoskarnet --- src/common/tortls.c | 13 ++++--------- 1 files changed, 4 insertions(+), 9 deletions(-) diff --git a/src/common/tortls.c b/src/common/tortls.c index 37074de..f7a15b0 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -777,15 +777,10 @@ tor_tls_context_new(crypto_pk_env_t *identity, unsigned int key_lifetime, } #if 0 - /* Tell OpenSSL to only use TLS1. This would actually break compatibility - * with clients that are configured to use SSLv23_method(), so we should - * probably never use it. - */ - /* XXX wanoskarnet says this comment is bunk -- that even if we turn - * this line on, clients configured to use SSLv23 would still able to - * talk to us. But he also says it's ok to leave it out. I suggest we - * delete this whole clause (the one that's #if 0'ed out). I'll leave - * it in place until Nick expresses an opinion. -RD */ + /* Tell OpenSSL to only use TLS1. This may have subtly different results + * from SSLv23_method() with SSLv2 and SSLv3 disabled, so we need to do some + * investigation before we consider adjusting it. It should be compatible + * with existing Tors. */ if (!(result->ctx = SSL_CTX_new(TLSv1_method()))) goto error; #endif

1 0

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.2'
by nickm＠torproject.org 09 Jan '12

09 Jan '12

commit 1e5d66997bb6efae378cf8783a0b07c12dd7146f Merge: 838ec08 c78a314 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jan 9 16:40:42 2012 -0500 Merge remote-tracking branch 'origin/maint-0.2.2' src/common/tortls.c | 13 ++++--------- 1 files changed, 4 insertions(+), 9 deletions(-)

1 0