- tor-commits - lists.torproject.org

[tor/master] Test for broken counter-mode at runtime
by nickm＠torproject.org 10 Jan '12

10 Jan '12

commit d29a3907338bd012ce5707e0e052747da87b3ba4 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jan 9 17:40:11 2012 -0500 Test for broken counter-mode at runtime To solve bug 4779, we want to avoid OpenSSL 1.0.0's counter mode. But Fedora (and maybe others) lie about the actual OpenSSL version, so we can't trust the header to tell us if it's safe. Instead, let's do a run-time test to see whether it's safe, and if not, use our built-in version. fermenthor contributed a pretty essential fixup to this patch. Thanks! --- changes/aes_ctr_test | 5 ++ src/common/aes.c | 141 +++++++++++++++++++++++++++++++++--------------- src/common/aes.h | 1 + src/common/crypto.c | 1 + src/test/test_crypto.c | 1 + 5 files changed, 106 insertions(+), 43 deletions(-) diff --git a/changes/aes_ctr_test b/changes/aes_ctr_test new file mode 100644 index 0000000..8b5af45 --- /dev/null +++ b/changes/aes_ctr_test @@ -0,0 +1,5 @@ + o Minor bugfixes + - Test for the OpenSSL 1.0.0 counter mode bug at runtime, not compile + time. This is necessary because OpenSSL has been hacked to mis-report + its version on a few distributions. + Bugfix on Tor 0.2.3.11-alpha. diff --git a/src/common/aes.c b/src/common/aes.c index 5791e66..f6288e8 100644 --- a/src/common/aes.c +++ b/src/common/aes.c @@ -18,10 +18,10 @@ #include <openssl/evp.h> #include <openssl/engine.h> #include "crypto.h" -#if OPENSSL_VERSION_NUMBER >= OPENSSL_V(1,0,0,'a') +#if OPENSSL_VERSION_NUMBER >= OPENSSL_V_SERIES(1,0,0) /* See comments about which counter mode implementation to use below. */ #include <openssl/modes.h> -#define USE_OPENSSL_CTR +#define CAN_USE_OPENSSL_CTR #endif #include "compat.h" #include "aes.h" @@ -62,7 +62,7 @@ struct aes_cnt_cipher { AES_KEY aes; } key; -#if !defined(WORDS_BIGENDIAN) && !defined(USE_OPENSSL_CTR) +#if !defined(WORDS_BIGENDIAN) #define USING_COUNTER_VARS /** These four values, together, implement a 128-bit counter, with * counter0 as the low-order word and counter3 as the high-order word. */ @@ -84,11 +84,7 @@ struct aes_cnt_cipher { /** The encrypted value of ctr_buf. */ uint8_t buf[16]; /** Our current stream position within buf. */ -#ifdef USE_OPENSSL_CTR unsigned int pos; -#else - uint8_t pos; -#endif /** True iff we're using the evp implementation of this cipher. */ uint8_t using_evp; @@ -98,6 +94,11 @@ struct aes_cnt_cipher { * we're testing it or because we have hardware acceleration configured */ static int should_use_EVP = 0; +#ifdef CAN_USE_OPENSSL_CTR +/**DOCDOC*/ +static int should_use_openssl_CTR = 0; +#endif + /** Check whether we should use the EVP interface for AES. If force_val * is nonnegative, we use use EVP iff it is true. Otherwise, we use EVP * if there is an engine enabled for aes-ecb. */ @@ -128,7 +129,50 @@ evaluate_evp_for_aes(int force_val) return 0; } -#ifndef USE_OPENSSL_CTR +/**DOCDOC*/ +int +evaluate_ctr_for_aes(void) +{ +#ifdef CAN_USE_OPENSSL_CTR + /* Result of encrypting an all-zero block with an all-zero 128-bit AES key. + * This should be the same as encrypting an all-zero block with an all-zero + * 128-bit AES key in counter mode, starting at position 0 of the stream. + */ + static const unsigned char encrypt_zero[] = + "\x66\xe9\x4b\xd4\xef\x8a\x2c\x3b\x88\x4c\xfa\x59\xca\x34\x2b\x2e"; + unsigned char zero[16]; + unsigned char output[16]; + unsigned char ivec[16]; + unsigned char ivec_tmp[16]; + unsigned int pos, i; + AES_KEY key; + memset(zero, 0, sizeof(zero)); + memset(ivec, 0, sizeof(ivec)); + AES_set_encrypt_key(zero, 128, &key); + + pos = 0; + /* Encrypting a block one byte at a time should make the error manifest + * itself for known bogus openssl versions. */ + for (i=0; i<16; ++i) + AES_ctr128_encrypt(&zero[i], &output[i], 1, &key, ivec, ivec_tmp, &pos); + + if (memcmp(output, encrypt_zero, 16)) { + /* Counter mode is buggy */ + log_notice(LD_CRYPTO, "This OpenSSL has a buggy version of counter mode; " + "not using it."); + } else { + /* Counter mode is okay */ + log_notice(LD_CRYPTO, "This OpenSSL has a good implementation of counter " + "mode; using it."); + should_use_openssl_CTR = 1; + } +#else + log_notice(LD_CRYPTO, "This version of OpenSSL has a slow implementation of " + "counter mode; not using it."); +#endif + return 0; +} + #if !defined(USING_COUNTER_VARS) #define COUNTER(c, n) ((c)->ctr_buf.buf32[3-(n)]) #else @@ -157,7 +201,6 @@ _aes_fill_buf(aes_cnt_cipher_t *cipher) AES_encrypt(cipher->ctr_buf.buf, cipher->buf, &cipher->key.aes); } } -#endif /** * Return a newly allocated counter-mode AES128 cipher implementation. @@ -203,11 +246,12 @@ aes_set_key(aes_cnt_cipher_t *cipher, const char *key, int key_bits) cipher->pos = 0; -#ifdef USE_OPENSSL_CTR - memset(cipher->buf, 0, sizeof(cipher->buf)); -#else - _aes_fill_buf(cipher); +#ifdef CAN_USE_OPENSSL_CTR + if (should_use_openssl_CTR) + memset(cipher->buf, 0, sizeof(cipher->buf)); + else #endif + _aes_fill_buf(cipher); } /** Release storage held by cipher @@ -232,7 +276,7 @@ aes_free_cipher(aes_cnt_cipher_t *cipher) #define UPDATE_CTR_BUF(c, n) #endif -#ifdef USE_OPENSSL_CTR +#ifdef CAN_USE_OPENSSL_CTR /* Helper function to use EVP with openssl's counter-mode wrapper. */ static void evp_block128_fn(const uint8_t in[16], uint8_t out[16], @@ -252,29 +296,34 @@ void aes_crypt(aes_cnt_cipher_t *cipher, const char *input, size_t len, char *output) { -#ifdef USE_OPENSSL_CTR - if (cipher->using_evp) { - /* In openssl 1.0.0, there's an if'd out EVP_aes_128_ctr in evp.h. If - * it weren't disabled, it might be better just to use that. - */ - CRYPTO_ctr128_encrypt((const unsigned char *)input, - (unsigned char *)output, - len, - &cipher->key.evp, - cipher->ctr_buf.buf, - cipher->buf, - &cipher->pos, - evp_block128_fn); - } else { - AES_ctr128_encrypt((const unsigned char *)input, - (unsigned char *)output, - len, - &cipher->key.aes, - cipher->ctr_buf.buf, - cipher->buf, - &cipher->pos); +#ifdef CAN_USE_OPENSSL_CTR + if (should_use_openssl_CTR) { + if (cipher->using_evp) { + /* In openssl 1.0.0, there's an if'd out EVP_aes_128_ctr in evp.h. If + * it weren't disabled, it might be better just to use that. + */ + CRYPTO_ctr128_encrypt((const unsigned char *)input, + (unsigned char *)output, + len, + &cipher->key.evp, + cipher->ctr_buf.buf, + cipher->buf, + &cipher->pos, + evp_block128_fn); + } else { + AES_ctr128_encrypt((const unsigned char *)input, + (unsigned char *)output, + len, + &cipher->key.aes, + cipher->ctr_buf.buf, + cipher->buf, + &cipher->pos); + } + return; } -#else + else +#endif + { int c = cipher->pos; if (PREDICT_UNLIKELY(!len)) return; @@ -297,7 +346,7 @@ aes_crypt(aes_cnt_cipher_t *cipher, const char *input, size_t len, UPDATE_CTR_BUF(cipher, 0); _aes_fill_buf(cipher); } -#endif + } } /** Encrypt len bytes from input, storing the results in place. @@ -307,9 +356,14 @@ aes_crypt(aes_cnt_cipher_t *cipher, const char *input, size_t len, void aes_crypt_inplace(aes_cnt_cipher_t *cipher, char *data, size_t len) { -#ifdef USE_OPENSSL_CTR - aes_crypt(cipher, data, len, data); -#else +#ifdef CAN_USE_OPENSSL_CTR + if (should_use_openssl_CTR) { + aes_crypt(cipher, data, len, data); + return; + } + else +#endif + { int c = cipher->pos; if (PREDICT_UNLIKELY(!len)) return; @@ -332,7 +386,7 @@ aes_crypt_inplace(aes_cnt_cipher_t *cipher, char *data, size_t len) UPDATE_CTR_BUF(cipher, 0); _aes_fill_buf(cipher); } -#endif + } } /** Reset the 128-bit counter of cipher to the 16-bit big-endian value @@ -349,8 +403,9 @@ aes_set_iv(aes_cnt_cipher_t *cipher, const char *iv) cipher->pos = 0; memcpy(cipher->ctr_buf.buf, iv, 16); -#ifndef USE_OPENSSL_CTR - _aes_fill_buf(cipher); +#ifdef CAN_USE_OPENSSL_CTR + if (!should_use_openssl_CTR) #endif + _aes_fill_buf(cipher); } diff --git a/src/common/aes.h b/src/common/aes.h index 221e846..f7f0319 100644 --- a/src/common/aes.h +++ b/src/common/aes.h @@ -25,6 +25,7 @@ void aes_crypt_inplace(aes_cnt_cipher_t *cipher, char *data, size_t len); void aes_set_iv(aes_cnt_cipher_t *cipher, const char *iv); int evaluate_evp_for_aes(int force_value); +int evaluate_ctr_for_aes(void); #endif diff --git a/src/common/crypto.c b/src/common/crypto.c index 35d6dfa..364b6a7 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -281,6 +281,7 @@ crypto_global_init(int useAccel, const char *accelName, const char *accelDir) } evaluate_evp_for_aes(-1); + evaluate_ctr_for_aes(); return crypto_seed_rng(1); } diff --git a/src/test/test_crypto.c b/src/test/test_crypto.c index cad8c2f..2adbcc9 100644 --- a/src/test/test_crypto.c +++ b/src/test/test_crypto.c @@ -105,6 +105,7 @@ test_crypto_aes(void *arg) int use_evp = !strcmp(arg,"evp"); evaluate_evp_for_aes(use_evp); + evaluate_ctr_for_aes(); data1 = tor_malloc(1024); data2 = tor_malloc(1024);

1 0

[tor/master] Clean up indentation in aes.c
by nickm＠torproject.org 10 Jan '12

10 Jan '12

commit cc5c14b7327924e7136f8709d69cf23761ab7a44 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jan 10 10:07:33 2012 -0500 Clean up indentation in aes.c --- src/common/aes.c | 76 +++++++++++++++++++++++++++--------------------------- 1 files changed, 38 insertions(+), 38 deletions(-) diff --git a/src/common/aes.c b/src/common/aes.c index f6288e8..3c315dc 100644 --- a/src/common/aes.c +++ b/src/common/aes.c @@ -324,28 +324,28 @@ aes_crypt(aes_cnt_cipher_t *cipher, const char *input, size_t len, else #endif { - int c = cipher->pos; - if (PREDICT_UNLIKELY(!len)) return; - - while (1) { - do { - if (len-- == 0) { cipher->pos = c; return; } - *(output++) = *(input++) ^ cipher->buf[c]; - } while (++c != 16); - cipher->pos = c = 0; - if (PREDICT_UNLIKELY(! ++COUNTER(cipher, 0))) { - if (PREDICT_UNLIKELY(! ++COUNTER(cipher, 1))) { - if (PREDICT_UNLIKELY(! ++COUNTER(cipher, 2))) { - ++COUNTER(cipher, 3); - UPDATE_CTR_BUF(cipher, 3); + int c = cipher->pos; + if (PREDICT_UNLIKELY(!len)) return; + + while (1) { + do { + if (len-- == 0) { cipher->pos = c; return; } + *(output++) = *(input++) ^ cipher->buf[c]; + } while (++c != 16); + cipher->pos = c = 0; + if (PREDICT_UNLIKELY(! ++COUNTER(cipher, 0))) { + if (PREDICT_UNLIKELY(! ++COUNTER(cipher, 1))) { + if (PREDICT_UNLIKELY(! ++COUNTER(cipher, 2))) { + ++COUNTER(cipher, 3); + UPDATE_CTR_BUF(cipher, 3); + } + UPDATE_CTR_BUF(cipher, 2); } - UPDATE_CTR_BUF(cipher, 2); + UPDATE_CTR_BUF(cipher, 1); } - UPDATE_CTR_BUF(cipher, 1); + UPDATE_CTR_BUF(cipher, 0); + _aes_fill_buf(cipher); } - UPDATE_CTR_BUF(cipher, 0); - _aes_fill_buf(cipher); - } } } @@ -364,28 +364,28 @@ aes_crypt_inplace(aes_cnt_cipher_t *cipher, char *data, size_t len) else #endif { - int c = cipher->pos; - if (PREDICT_UNLIKELY(!len)) return; - - while (1) { - do { - if (len-- == 0) { cipher->pos = c; return; } - *(data++) ^= cipher->buf[c]; - } while (++c != 16); - cipher->pos = c = 0; - if (PREDICT_UNLIKELY(! ++COUNTER(cipher, 0))) { - if (PREDICT_UNLIKELY(! ++COUNTER(cipher, 1))) { - if (PREDICT_UNLIKELY(! ++COUNTER(cipher, 2))) { - ++COUNTER(cipher, 3); - UPDATE_CTR_BUF(cipher, 3); + int c = cipher->pos; + if (PREDICT_UNLIKELY(!len)) return; + + while (1) { + do { + if (len-- == 0) { cipher->pos = c; return; } + *(data++) ^= cipher->buf[c]; + } while (++c != 16); + cipher->pos = c = 0; + if (PREDICT_UNLIKELY(! ++COUNTER(cipher, 0))) { + if (PREDICT_UNLIKELY(! ++COUNTER(cipher, 1))) { + if (PREDICT_UNLIKELY(! ++COUNTER(cipher, 2))) { + ++COUNTER(cipher, 3); + UPDATE_CTR_BUF(cipher, 3); + } + UPDATE_CTR_BUF(cipher, 2); } - UPDATE_CTR_BUF(cipher, 2); + UPDATE_CTR_BUF(cipher, 1); } - UPDATE_CTR_BUF(cipher, 1); + UPDATE_CTR_BUF(cipher, 0); + _aes_fill_buf(cipher); } - UPDATE_CTR_BUF(cipher, 0); - _aes_fill_buf(cipher); - } } }

1 0

[tor/master] Add missing documentation for counter-mode checks
by nickm＠torproject.org 10 Jan '12

10 Jan '12

commit dca3c9fff87227b8119afe804ce0ae8ed840b1f8 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jan 10 11:13:45 2012 -0500 Add missing documentation for counter-mode checks --- src/common/aes.c | 17 ++++++++++++----- 1 files changed, 12 insertions(+), 5 deletions(-) diff --git a/src/common/aes.c b/src/common/aes.c index 3c315dc..da7220f 100644 --- a/src/common/aes.c +++ b/src/common/aes.c @@ -47,8 +47,8 @@ * OpenSSL pre-1.0 (by about 10%!). But OpenSSL 1.0.0 added a counter mode * implementation faster than the one here (by about 7%). So we pick which * one to used based on the Openssl version above. (OpenSSL 1.0.0a fixed a - * critical bug in that counter mode implementation, so we actually require - * that one.) + * critical bug in that counter mode implementation, so we need to test to + * make sure that we have a fixed version.) */ /*======================================================================*/ @@ -90,12 +90,13 @@ struct aes_cnt_cipher { uint8_t using_evp; }; -/** True if we should prefer the EVP implementation for AES, either because +/** True iff we should prefer the EVP implementation for AES, either because * we're testing it or because we have hardware acceleration configured */ static int should_use_EVP = 0; #ifdef CAN_USE_OPENSSL_CTR -/**DOCDOC*/ +/** True iff we have tested the counter-mode implementation and found that it + * doesn't have the counter-mode bug from OpenSSL 1.0.0. */ static int should_use_openssl_CTR = 0; #endif @@ -129,7 +130,13 @@ evaluate_evp_for_aes(int force_val) return 0; } -/**DOCDOC*/ +/** Test the OpenSSL counter mode implementation to see whether it has the + * counter-mode bug from OpenSSL 1.0.0. If the implementation works, then + * we will use it for future encryption/decryption operations. + * + * We can't just look at the OpenSSL version, since some distributions update + * their OpenSSL packages without changing the version number. + **/ int evaluate_ctr_for_aes(void) {

1 0

[tor/master] We no longer need to detect openssl without RAND_poll()
by nickm＠torproject.org 10 Jan '12

10 Jan '12

commit 5741aef3dc0dc245ab930c21b277a5a829c9970d Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jan 5 15:08:05 2012 -0500 We no longer need to detect openssl without RAND_poll() We require openssl 0.9.7 or later, and RAND_poll() was first added in openssl 0.9.6. --- changes/readable_ssl_versions | 2 ++ src/common/crypto.c | 10 +--------- 2 files changed, 3 insertions(+), 9 deletions(-) diff --git a/changes/readable_ssl_versions b/changes/readable_ssl_versions index 8c8e06c..f34998c 100644 --- a/changes/readable_ssl_versions +++ b/changes/readable_ssl_versions @@ -1,4 +1,6 @@ o Code simplification and refactoring: - Use macros to indicate OpenSSL versions, so we don't need to worry about accidental hexadecimal bit shifts. + - Remove some workaround code for OpenSSL 0.9.6, which is no longer + supported. diff --git a/src/common/crypto.c b/src/common/crypto.c index aa8ceed..35d6dfa 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -2360,12 +2360,6 @@ crypto_dh_free(crypto_dh_env_t *dh) * work for us too. */ #define ADD_ENTROPY 32 -/** True iff we should use OpenSSL's RAND_poll function to add entropy to its - * pool. - * - * Use RAND_poll if OpenSSL is 0.9.6 release or later. */ -#define HAVE_RAND_POLL (OPENSSL_VERSION_NUMBER >= OPENSSL_V_NOPATCH(0,9,6)) - /** True iff it's safe to use RAND_poll after setup. * * Versions of OpenSSL prior to 0.9.7k and 0.9.8c had a bug where RAND_poll @@ -2409,8 +2403,7 @@ crypto_seed_rng(int startup) size_t n; #endif -#if HAVE_RAND_POLL - /* OpenSSL 0.9.6 adds a RAND_poll function that knows about more kinds of + /* OpenSSL has a RAND_poll function that knows about more kinds of * entropy than we do. We'll try calling that, *and* calling our own entropy * functions. If one succeeds, we'll accept the RNG as seeded. */ if (startup || RAND_POLL_IS_SAFE) { @@ -2418,7 +2411,6 @@ crypto_seed_rng(int startup) if (rand_poll_status == 0) log_warn(LD_CRYPTO, "RAND_poll() failed."); } -#endif #ifdef MS_WINDOWS if (!provider_set) {

1 0

[tor/master] Add macros to construct openssl version numbers
by nickm＠torproject.org 10 Jan '12

10 Jan '12

commit 85c7d7659ea1b9c99c13596e943260ad2e396483 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jan 5 15:05:17 2012 -0500 Add macros to construct openssl version numbers It's a pain to convert 0x0090813f to and from 0.9.8s-release on the fly, so these macros should help. --- changes/readable_ssl_versions | 4 ++++ src/common/aes.c | 3 ++- src/common/crypto.c | 19 +++++++++---------- src/common/crypto.h | 32 ++++++++++++++++++++++++++++++++ src/common/tortls.c | 28 ++++++++++++++-------------- 5 files changed, 61 insertions(+), 25 deletions(-) diff --git a/changes/readable_ssl_versions b/changes/readable_ssl_versions new file mode 100644 index 0000000..8c8e06c --- /dev/null +++ b/changes/readable_ssl_versions @@ -0,0 +1,4 @@ + o Code simplification and refactoring: + - Use macros to indicate OpenSSL versions, so we don't need to worry + about accidental hexadecimal bit shifts. + diff --git a/src/common/aes.c b/src/common/aes.c index 9487cdd..5791e66 100644 --- a/src/common/aes.c +++ b/src/common/aes.c @@ -17,7 +17,8 @@ #include <openssl/aes.h> #include <openssl/evp.h> #include <openssl/engine.h> -#if OPENSSL_VERSION_NUMBER >= 0x1000001fL +#include "crypto.h" +#if OPENSSL_VERSION_NUMBER >= OPENSSL_V(1,0,0,'a') /* See comments about which counter mode implementation to use below. */ #include <openssl/modes.h> #define USE_OPENSSL_CTR diff --git a/src/common/crypto.c b/src/common/crypto.c index d1d823d..aa8ceed 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -60,7 +60,7 @@ #include "container.h" #include "compat.h" -#if OPENSSL_VERSION_NUMBER < 0x00907000l +#if OPENSSL_VERSION_NUMBER < OPENSSL_V_SERIES(0,9,7) #error "We require OpenSSL >= 0.9.7" #endif @@ -72,7 +72,7 @@ /** Longest recognized */ #define MAX_DNS_LABEL_SIZE 63 -#if OPENSSL_VERSION_NUMBER < 0x00908000l +#if OPENSSL_VERSION_NUMBER < OPENSSL_V_SERIES(0,9,8) /** @{ */ /** On OpenSSL versions before 0.9.8, there is no working SHA256 * implementation, so we use Tom St Denis's nice speedy one, slightly adapted @@ -452,7 +452,7 @@ crypto_pk_generate_key_with_bits(crypto_pk_env_t *env, int bits) if (env->key) RSA_free(env->key); -#if OPENSSL_VERSION_NUMBER < 0x00908000l +#if OPENSSL_VERSION_NUMBER < OPENSSL_V_SERIES(0,9,8) /* In OpenSSL 0.9.7, RSA_generate_key is all we have. */ env->key = RSA_generate_key(bits, 65537, NULL, NULL); #else @@ -1723,7 +1723,7 @@ crypto_hmac_sha256(char *hmac_out, const char *key, size_t key_len, const char *msg, size_t msg_len) { -#if (OPENSSL_VERSION_NUMBER >= 0x00908000l) +#if OPENSSL_VERSION_NUMBER >= OPENSSL_V_SERIES(0,9,8) /* If we've got OpenSSL >=0.9.8 we can use its hmac implementation. */ tor_assert(key_len < INT_MAX); tor_assert(msg_len < INT_MAX); @@ -2363,9 +2363,8 @@ crypto_dh_free(crypto_dh_env_t *dh) /** True iff we should use OpenSSL's RAND_poll function to add entropy to its * pool. * - * Use RAND_poll if OpenSSL is 0.9.6 release or later. (The "f" means - *"release".) */ -#define HAVE_RAND_POLL (OPENSSL_VERSION_NUMBER >= 0x0090600fl) + * Use RAND_poll if OpenSSL is 0.9.6 release or later. */ +#define HAVE_RAND_POLL (OPENSSL_VERSION_NUMBER >= OPENSSL_V_NOPATCH(0,9,6)) /** True iff it's safe to use RAND_poll after setup. * @@ -2374,9 +2373,9 @@ crypto_dh_free(crypto_dh_env_t *dh) * that fd without checking whether it fit in the fd_set. Thus, if the * system has not just been started up, it is unsafe to call */ #define RAND_POLL_IS_SAFE \ - ((OPENSSL_VERSION_NUMBER >= 0x009070afl && \ - OPENSSL_VERSION_NUMBER <= 0x00907fffl) || \ - (OPENSSL_VERSION_NUMBER >= 0x0090803fl)) + ((OPENSSL_VERSION_NUMBER >= OPENSSL_V(0,9,7,'j') && \ + OPENSSL_VERSION_NUMBER < OPENSSL_V_SERIES(0,9,8)) || \ + OPENSSL_VERSION_NUMBER >= OPENSSL_V(0,9,8,'c')) /** Set the seed of the weak RNG to a random value. */ static void diff --git a/src/common/crypto.h b/src/common/crypto.h index 771c49c..4783654 100644 --- a/src/common/crypto.h +++ b/src/common/crypto.h @@ -16,6 +16,38 @@ #include <stdio.h> #include "torint.h" +/* + Macro to create an arbitrary OpenSSL version number as used by + OPENSSL_VERSION_NUMBER or SSLeay(), since the actual numbers are a bit hard + to read. + + Don't use this directly, instead use one of the other OPENSSL_V macros + below. + + The format is: 4 bits major, 8 bits minor, 8 bits fix, 8 bits patch, 4 bit + status. + */ +#define OPENSSL_VER(a,b,c,d,e) \ + (((a)<<28) | \ + ((b)<<20) | \ + ((c)<<12) | \ + ((d)<< 4) | \ + (e)) +/** An openssl release number. For example, OPENSSL_V(0,9,8,'j') is the + * version for the released version of 0.9.8j */ +#define OPENSSL_V(a,b,c,d) \ + OPENSSL_VER((a),(b),(c),(d)-'a'+1,0xf) +/** An openssl release number for the first release in the series. For + * example, OPENSSL_V_NOPATCH(1,0,0) is the first released version of OpenSSL + * 1.0.0. */ +#define OPENSSL_V_NOPATCH(a,b,c) \ + OPENSSL_VER((a),(b),(c),0,0xf) +/** The first version that would occur for any alpha or beta in an openssl + * series. For example, OPENSSL_V_SERIES(0,9,8) is greater than any released + * 0.9.7, and less than any released 0.9.8. */ +#define OPENSSL_V_SERIES(a,b,c) \ + OPENSSL_VER((a),(b),(c),0,0) + /** Length of the output of our message digest. */ #define DIGEST_LEN 20 /** Length of the output of our second (improved) message digests. (For now diff --git a/src/common/tortls.c b/src/common/tortls.c index 832f744..834e5f1 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -44,10 +44,6 @@ #include <openssl/bio.h> #include <openssl/opensslv.h> -#if OPENSSL_VERSION_NUMBER < 0x00907000l -#error "We require OpenSSL >= 0.9.7" -#endif - #ifdef USE_BUFFEREVENTS #include <event2/bufferevent_ssl.h> #include <event2/buffer.h> @@ -65,6 +61,10 @@ #include "container.h" #include <string.h> +#if OPENSSL_VERSION_NUMBER < OPENSSL_V_SERIES(0,9,7) +#error "We require OpenSSL >= 0.9.7" +#endif + /* Enable the "v2" TLS handshake. */ #define V2_HANDSHAKE_SERVER @@ -79,9 +79,9 @@ #define ADDR(tls) (((tls) && (tls)->address) ? tls->address : "peer") -#if (OPENSSL_VERSION_NUMBER < 0x0090813fL || \ - (OPENSSL_VERSION_NUMBER >= 0x00909000L && \ - OPENSSL_VERSION_NUMBER < 0x1000006fL)) +#if (OPENSSL_VERSION_NUMBER < OPENSSL_V(0,9,8,'s') || \ + (OPENSSL_VERSION_NUMBER >= OPENSSL_V_SERIES(0,9,9) && \ + OPENSSL_VERSION_NUMBER < OPENSSL_V(1,0,0,'f'))) /* This is a version of OpenSSL before 0.9.8s/1.0.0f. It does not have * the CVE-2011-4657 fix, and as such it can't use RELEASE_BUFFERS and * SSL3 safely at the same time. @@ -474,18 +474,18 @@ tor_tls_init(void) * program should be allowed to use renegotiation unless it first passed * a test of intelligence and determination. */ - if (version >= 0x009080c0L && version < 0x009080d0L) { + if (version > OPENSSL_V(0,9,8,'k') && version <= OPENSSL_V(0,9,8,'l')) { log_notice(LD_GENERAL, "OpenSSL %s looks like version 0.9.8l; " "I will try SSL3_FLAGS to enable renegotation.", SSLeay_version(SSLEAY_VERSION)); use_unsafe_renegotiation_flag = 1; use_unsafe_renegotiation_op = 1; - } else if (version >= 0x009080d0L) { + } else if (version > OPENSSL_V(0,9,8,'l')) { log_notice(LD_GENERAL, "OpenSSL %s looks like version 0.9.8m or later; " "I will try SSL_OP to enable renegotiation", SSLeay_version(SSLEAY_VERSION)); use_unsafe_renegotiation_op = 1; - } else if (version < 0x009080c0L) { + } else if (version <= OPENSSL_V(0,9,8,'k')) { log_notice(LD_GENERAL, "OpenSSL %s [%lx] looks like it's older than " "0.9.8l, but some vendors have backported 0.9.8l's " "renegotiation code to earlier versions, and some have " @@ -770,7 +770,7 @@ tor_cert_decode(const uint8_t *certificate, size_t certificate_len) if (certificate_len > INT_MAX) return NULL; -#if OPENSSL_VERSION_NUMBER < 0x00908000l +#if OPENSSL_VERSION_NUMBER < OPENSSL_V_SERIES(0,9,8) /* This ifdef suppresses a type warning. Take out this case once everybody * is using OpenSSL 0.9.8 or later. */ x509 = d2i_X509(NULL, (unsigned char**)&cp, (int)certificate_len); @@ -1177,9 +1177,9 @@ tor_tls_context_new(crypto_pk_env_t *identity, unsigned int key_lifetime, #ifdef DISABLE_SSL3_HANDSHAKE 1 || #endif - SSLeay() < 0x0090813fL || - (SSLeay() >= 0x00909000L && - SSLeay() < 0x1000006fL)) { + SSLeay() < OPENSSL_V(0,9,8,'s') || + (SSLeay() >= OPENSSL_V_SERIES(0,9,9) && + SSLeay() < OPENSSL_V(1,0,0,'f'))) { /* And not SSL3 if it's subject to CVE-2011-4657. */ log_info(LD_NET, "Disabling SSLv3 because this OpenSSL version " "might otherwise be vulnerable to CVE-2011-4657 "

1 0

[tor/master] Merge branch 'openssl_versions_squashed'
by nickm＠torproject.org 10 Jan '12

10 Jan '12

commit b443d6a4fbfaac8d4a944d8b2a763666d1683ada Merge: 6b9298e 5741aef Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jan 10 10:41:03 2012 -0500 Merge branch 'openssl_versions_squashed' changes/readable_ssl_versions | 6 ++++++ src/common/aes.c | 3 ++- src/common/crypto.c | 25 ++++++++----------------- src/common/crypto.h | 32 ++++++++++++++++++++++++++++++++ src/common/tortls.c | 28 ++++++++++++++-------------- 5 files changed, 62 insertions(+), 32 deletions(-)

1 0

[tor/master] Log which votes we still need to fetch
by nickm＠torproject.org 10 Jan '12

10 Jan '12

commit 6b9298ef72997c1cd0ed2e9c47abeb6c06f64f9f Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Tue Jan 10 16:12:22 2012 +0100 Log which votes we still need to fetch This might help us see which authorities are problematic in getting their vote published the first time. --- changes/dirauth_log | 3 +++ src/or/dirvote.c | 9 +++++++-- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/changes/dirauth_log b/changes/dirauth_log new file mode 100644 index 0000000..df82314 --- /dev/null +++ b/changes/dirauth_log @@ -0,0 +1,3 @@ + o Minor features: + - Log which authority we're missing votes from when we go to fetch them + from the other auths. diff --git a/src/or/dirvote.c b/src/or/dirvote.c index 2843336..3bb165a 100644 --- a/src/or/dirvote.c +++ b/src/or/dirvote.c @@ -2801,8 +2801,13 @@ dirvote_fetch_missing_votes(void) smartlist_free(missing_fps); return; } - log_notice(LOG_NOTICE, "We're missing votes from %d authorities. Asking " - "every other authority for a copy.", smartlist_len(missing_fps)); + { + char *tmp = smartlist_join_strings(missing_fps, " ", 0, NULL); + log_notice(LOG_NOTICE, "We're missing votes from %d authorities (%s). " + "Asking every other authority for a copy.", + smartlist_len(missing_fps), tmp); + tor_free(tmp); + } resource = smartlist_join_strings(missing_fps, "+", 0, NULL); directory_get_from_all_authorities(DIR_PURPOSE_FETCH_STATUS_VOTE, 0, resource);

1 0

[tor/master] Advertise dirport if accountingmax is large enough
by nickm＠torproject.org 10 Jan '12

10 Jan '12

commit 50a50392b7d65409de4416eb604bec6339670a2c Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Tue Jan 25 16:45:27 2011 +0100 Advertise dirport if accountingmax is large enough When we have an effective bandwidthrate configured so that we cannot exceed our bandwidth limit in one accounting interval, don't disable advertising the dirport. Implements ticket 2434. --- changes/bug2434 | 6 ++++++ src/or/hibernate.c | 18 ++++++++++++------ src/or/hibernate.h | 1 + src/or/router.c | 23 ++++++++++++++++++++--- 4 files changed, 39 insertions(+), 9 deletions(-) diff --git a/changes/bug2434 b/changes/bug2434 new file mode 100644 index 0000000..5fd3d11 --- /dev/null +++ b/changes/bug2434 @@ -0,0 +1,6 @@ + o Minor features: + - Don't disable the DirPort when we cannot exceed our AccountingMax + limit during this interval because the effective bandwidthrate is + low enough. This is useful in a situation where AccountMax is only + used as an additional safeguard or to provide statistics. + diff --git a/src/or/hibernate.c b/src/or/hibernate.c index ce64581..803f7f5 100644 --- a/src/or/hibernate.c +++ b/src/or/hibernate.c @@ -242,6 +242,14 @@ accounting_is_enabled(const or_options_t *options) return 0; } +/** If accounting is enabled, return how long (in seconds) this + * interval lasts. */ +int +accounting_get_interval_length(void) +{ + return (int)(interval_end_time - interval_start_time); +} + /** Called from main.c to tell us that seconds seconds have * passed, n_read bytes have been read, and n_written * bytes have been written. */ @@ -504,7 +512,6 @@ accounting_set_wakeup_time(void) { char digest[DIGEST_LEN]; crypto_digest_env_t *d_env; - int time_in_interval; uint64_t time_to_exhaust_bw; int time_to_consider; @@ -538,22 +545,21 @@ accounting_set_wakeup_time(void) interval_wakeup_time = interval_start_time; log_notice(LD_ACCT, - "Configured hibernation. This interval begins at %s " - "and ends at %s. We have no prior estimate for bandwidth, so " + "Configured hibernation. This interval begins at %s " + "and ends at %s. We have no prior estimate for bandwidth, so " "we will start out awake and hibernate when we exhaust our quota.", buf1, buf2); return; } - time_in_interval = (int)(interval_end_time - interval_start_time); - time_to_exhaust_bw = (get_options()->AccountingMax/expected_bandwidth_usage)*60; if (time_to_exhaust_bw > INT_MAX) { time_to_exhaust_bw = INT_MAX; time_to_consider = 0; } else { - time_to_consider = time_in_interval - (int)time_to_exhaust_bw; + time_to_consider = accounting_get_interval_length() - + (int)time_to_exhaust_bw; } if (time_to_consider<=0) { diff --git a/src/or/hibernate.h b/src/or/hibernate.h index 78e7bb7..d77e946 100644 --- a/src/or/hibernate.h +++ b/src/or/hibernate.h @@ -14,6 +14,7 @@ int accounting_parse_options(const or_options_t *options, int validate_only); int accounting_is_enabled(const or_options_t *options); +int accounting_get_interval_length(void); void configure_accounting(time_t now); void accounting_run_housekeeping(time_t now); void accounting_add_bytes(size_t n_read, size_t n_written, int seconds); diff --git a/src/or/router.c b/src/or/router.c index a08a200..b2df383 100644 --- a/src/or/router.c +++ b/src/or/router.c @@ -823,9 +823,26 @@ decide_to_advertise_dirport(const or_options_t *options, uint16_t dir_port) * make us choose not to publish. */ if (accounting_is_enabled(options)) { - /* if we might potentially hibernate */ - new_choice = 0; - reason = "AccountingMax enabled"; + /* Don't spend bytes for directory traffic if we could end up hibernating, + * but allow DirPort otherwise. Some people set AccountingMax because + * they're confused or to get statistics. */ + int interval_length = accounting_get_interval_length(); + uint32_t effective_bw = get_effective_bwrate(options); + if (!interval_length) { + log_warn(LD_BUG, "An accounting interval is not allowed to be zero " + "seconds long. Raising to 1."); + interval_length = 1; + } + log_info(LD_GENERAL, "Calculating whether to disable dirport: effective " + "bwrate: %u, AccountingMax: "U64_FORMAT", " + "accounting interval length %d", effective_bw, + U64_PRINTF_ARG(options->AccountingMax), + interval_length); + if (effective_bw >= + options->AccountingMax / interval_length) { + new_choice = 0; + reason = "AccountingMax enabled"; + } #define MIN_BW_TO_ADVERTISE_DIRPORT 51200 } else if (options->BandwidthRate < MIN_BW_TO_ADVERTISE_DIRPORT || (options->RelayBandwidthRate > 0 &&

1 0

[tor/master] Merge remote-tracking branch 'rransom-tor/bug4883'
by nickm＠torproject.org 10 Jan '12

10 Jan '12

commit 2a9b279163da4ba0d870dd5e9b7fc1ae9591127c Merge: 2367f7e 72ed4a4 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jan 10 09:33:55 2012 -0500 Merge remote-tracking branch 'rransom-tor/bug4883' src/or/rendclient.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)

1 0

[tor/master] Fix brown-paper-bag bug in #4759 fix
by nickm＠torproject.org 10 Jan '12

10 Jan '12

commit 72ed4a41f5716923ce16d168ad421cc26ab2fbea Author: Robert Ransom <rransom.8774(a)gmail.com> Date: Mon Jan 9 22:03:04 2012 -0800 Fix brown-paper-bag bug in #4759 fix Fixes #4883, not yet in any release. --- src/or/rendclient.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/or/rendclient.c b/src/or/rendclient.c index 17c92ab..dff8bc3 100644 --- a/src/or/rendclient.c +++ b/src/or/rendclient.c @@ -278,7 +278,7 @@ rend_client_send_introduction(origin_circuit_t *introcirc, /* Copy the rendezvous cookie from rendcirc to introcirc, so that * when introcirc gets an ack, we can change the state of the right * rendezvous circuit. */ - memcpy(rendcirc->rend_data->rend_cookie, introcirc->rend_data->rend_cookie, + memcpy(introcirc->rend_data->rend_cookie, rendcirc->rend_data->rend_cookie, REND_COOKIE_LEN); log_info(LD_REND, "Sending an INTRODUCE1 cell");

1 0