- tor-commits - lists.torproject.org

[metrics-lib/master] Fix indentation.
by karsten＠torproject.org 10 Jan '12

10 Jan '12

commit 64ed56619822504c643a34c23f739556e7e83898 Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Tue Jan 10 19:35:06 2012 +0100 Fix indentation. --- .../torproject/descriptor/impl/ParseHelper.java | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/org/torproject/descriptor/impl/ParseHelper.java b/src/org/torproject/descriptor/impl/ParseHelper.java index 1f03517..3f80ddb 100644 --- a/src/org/torproject/descriptor/impl/ParseHelper.java +++ b/src/org/torproject/descriptor/impl/ParseHelper.java @@ -15,7 +15,7 @@ import org.apache.commons.codec.binary.Hex; public class ParseHelper { private static Pattern ipv4Pattern = - Pattern.compile("^[0-9\\.]{7,15}$"); + Pattern.compile("^[0-9\\.]{7,15}$"); public static String parseIpv4Address(String line, String address) throws DescriptorParseException { boolean isValid = true;

1 0

[translation/vidalia] Update translations for vidalia
by translation＠torproject.org 10 Jan '12

10 Jan '12

commit dbb636f0777a1d248d5ce5663548eddca439531b Author: Translation commit bot <translation(a)torproject.org> Date: Tue Jan 10 18:15:16 2012 +0000 Update translations for vidalia --- ca/vidalia_ca.po | 193 +++++++++++++++++++++++++++++------------------------- 1 files changed, 103 insertions(+), 90 deletions(-) diff --git a/ca/vidalia_ca.po b/ca/vidalia_ca.po index a2f3cbe..0f97df3 100755 --- a/ca/vidalia_ca.po +++ b/ca/vidalia_ca.po @@ -6,7 +6,7 @@ msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: https://trac.torproject.org/projects/tor\n" "POT-Creation-Date: 2011-09-07 14:40+0000\n" -"PO-Revision-Date: 2012-01-10 17:43+0000\n" +"PO-Revision-Date: 2012-01-10 18:12+0000\n" "Last-Translator: Gerard Farràs Ballabriga <>\n" "Language-Team: translations(a)vidalia-project.net\n" "MIME-Version: 1.0\n" @@ -454,7 +454,7 @@ msgstr "" msgctxt "ControlSocket" msgid "Error sending control command. [%1]" -msgstr "" +msgstr "Error en la tramesa de la comanda de control. [%1]" msgctxt "ControlSocket" msgid "Socket disconnected while attempting to read a line of data." @@ -466,31 +466,31 @@ msgstr "" msgctxt "CountryInfo" msgid "Afghanistan" -msgstr "" +msgstr "Afganistan" msgctxt "CountryInfo" msgid "Andorra" -msgstr "" +msgstr "Andorra" msgctxt "CountryInfo" msgid "Angola" -msgstr "" +msgstr "Angola" msgctxt "CountryInfo" msgid "Antigua & Barbuda" -msgstr "" +msgstr "Antigua i Barbuda" msgctxt "CountryInfo" msgid "Argentina" -msgstr "" +msgstr "Argentina" msgctxt "CountryInfo" msgid "Armenia" -msgstr "" +msgstr "Armènia" msgctxt "CountryInfo" msgid "Australia" -msgstr "" +msgstr "Austràlia" msgctxt "CountryInfo" msgid "Azerbaijan" @@ -514,7 +514,7 @@ msgstr "" msgctxt "CountryInfo" msgid "Belgium" -msgstr "" +msgstr "Bèlgica" msgctxt "CountryInfo" msgid "Belize" @@ -526,7 +526,7 @@ msgstr "" msgctxt "CountryInfo" msgid "Bolivia" -msgstr "" +msgstr "Bolívia" msgctxt "CountryInfo" msgid "Bosnia & Herzegovina" @@ -538,7 +538,7 @@ msgstr "" msgctxt "CountryInfo" msgid "Brazil" -msgstr "" +msgstr "Brasil" msgctxt "CountryInfo" msgid "Brunei Darussalam" @@ -546,7 +546,7 @@ msgstr "" msgctxt "CountryInfo" msgid "Bulgaria" -msgstr "" +msgstr "Bulgària" msgctxt "CountryInfo" msgid "Burkina Faso" @@ -562,11 +562,11 @@ msgstr "" msgctxt "CountryInfo" msgid "Cameroon" -msgstr "" +msgstr "Camerun" msgctxt "CountryInfo" msgid "Canada" -msgstr "" +msgstr "Canadà" msgctxt "CountryInfo" msgid "Cape Verde" @@ -582,15 +582,15 @@ msgstr "" msgctxt "CountryInfo" msgid "Chile" -msgstr "" +msgstr "Xile" msgctxt "CountryInfo" msgid "China" -msgstr "" +msgstr "Xina" msgctxt "CountryInfo" msgid "Colombia" -msgstr "" +msgstr "Colòmbia" msgctxt "CountryInfo" msgid "Comoros" @@ -606,7 +606,7 @@ msgstr "" msgctxt "CountryInfo" msgid "Costa Rica" -msgstr "" +msgstr "Costa Rica" msgctxt "CountryInfo" msgid "Cote dâIvoire" @@ -614,7 +614,7 @@ msgstr "" msgctxt "CountryInfo" msgid "Croatia" -msgstr "" +msgstr "Croàcia" msgctxt "CountryInfo" msgid "Cuba" @@ -1311,7 +1311,7 @@ msgstr "" msgctxt "GeneralPage" msgid "Executables (*.exe)" -msgstr "" +msgstr "Executables (*.exe)" msgctxt "GeneralPage" msgid "Select Path to Tor" @@ -1323,31 +1323,31 @@ msgstr "" msgctxt "GeneralPage" msgid "You must specify the name of your Tor executable." -msgstr "" +msgstr "Heu d'especificar el nom de l'executable del Tor" msgctxt "GeneralPage" msgid "Start Vidalia when my system starts" -msgstr "" +msgstr "Executa Vidalia quan el sistema arranqui" msgctxt "GeneralPage" msgid "Browse" -msgstr "" +msgstr "Navega" msgctxt "GeneralPage" msgid "Start the Tor software when Vidalia starts" -msgstr "" +msgstr "Executa el Tor quan arranqui Vidalia" msgctxt "GeneralPage" msgid "Tor" -msgstr "" +msgstr "Tor" msgctxt "GeneralPage" msgid "Proxy Application (optional)" -msgstr "" +msgstr "Aplicació de proxy (opcional)" msgctxt "GeneralPage" msgid "Start a proxy application when Tor starts" -msgstr "" +msgstr "Arranca l'aplicació de proxy quan arranqui el Tor" msgctxt "GeneralPage" msgid "Proxy Application Arguments:" @@ -1355,7 +1355,7 @@ msgstr "" msgctxt "GeneralPage" msgid "Software Updates" -msgstr "" +msgstr "Actualitzacions de programari" msgctxt "GeneralPage" msgid "Check for new software updates automatically" @@ -1395,43 +1395,43 @@ msgstr "" msgctxt "HelpBrowser" msgid "Search reached end of document" -msgstr "" +msgstr "La recerca ha arribat al final del document" msgctxt "HelpBrowser" msgid "Search reached start of document" -msgstr "" +msgstr "La recerca ha arribat a l'inici del document" msgctxt "HelpBrowser" msgid "Text not found in document" -msgstr "" +msgstr "El text no ha estat trobat en el document" msgctxt "HelpBrowser" msgid "Found %1 results" -msgstr "" +msgstr "S'han trobat %1 resultats" msgctxt "HelpBrowser" msgid "Vidalia Help" -msgstr "" +msgstr "Ajuda de Vidalia" msgctxt "HelpBrowser" msgid "Back" -msgstr "" +msgstr "Enrera" msgctxt "HelpBrowser" msgid "Move to previous page (Backspace)" -msgstr "" +msgstr "Mou a la pàgina prèvia (Backspace)" msgctxt "HelpBrowser" msgid "Backspace" -msgstr "" +msgstr "Retrocés" msgctxt "HelpBrowser" msgid "Forward" -msgstr "" +msgstr "Avança" msgctxt "HelpBrowser" msgid "Move to next page (Shift+Backspace)" -msgstr "" +msgstr "Mou a la pàgina següent (Shift+Backspace)" msgctxt "HelpBrowser" msgid "Shift+Backspace" @@ -1439,87 +1439,87 @@ msgstr "" msgctxt "HelpBrowser" msgid "Home" -msgstr "" +msgstr "Inici" msgctxt "HelpBrowser" msgid "Move to the Home page (Ctrl+H)" -msgstr "" +msgstr "Vés a la pàgina d'inici (Ctrl+H)" msgctxt "HelpBrowser" msgid "Ctrl+H" -msgstr "" +msgstr "Ctrl+H" msgctxt "HelpBrowser" msgid "Find" -msgstr "" +msgstr "Cerca" msgctxt "HelpBrowser" msgid "Search for a word or phrase on current page (Ctrl+F)" -msgstr "" +msgstr "Cerca per una paraula o frase en la pàgina actual (Ctrl+F)" msgctxt "HelpBrowser" msgid "Ctrl+F" -msgstr "" +msgstr "Ctrl+F" msgctxt "HelpBrowser" msgid "Close" -msgstr "" +msgstr "Tanca" msgctxt "HelpBrowser" msgid "Close Vidalia Help" -msgstr "" +msgstr "Tanca l'ajuda de Vidalia" msgctxt "HelpBrowser" msgid "Esc" -msgstr "" +msgstr "Esc" msgctxt "HelpBrowser" msgid "Find:" -msgstr "" +msgstr "Cerca:" msgctxt "HelpBrowser" msgid "Find Previous" -msgstr "" +msgstr "Cerca anterior" msgctxt "HelpBrowser" msgid "Find Next" -msgstr "" +msgstr "Cerca següent" msgctxt "HelpBrowser" msgid "Case sensitive" -msgstr "" +msgstr "Distingeix majúscules i minúscules" msgctxt "HelpBrowser" msgid "Whole words only" -msgstr "" +msgstr "Només paraules senceres" msgctxt "HelpBrowser" msgid "Help Topics" -msgstr "" +msgstr "Temes d'ajuda" msgctxt "HelpBrowser" msgid "Contents" -msgstr "" +msgstr "Continguts" msgctxt "HelpBrowser" msgid "Search" -msgstr "" +msgstr "Recerca" msgctxt "HelpBrowser" msgid "Searching for:" -msgstr "" +msgstr "Recerca per:" msgctxt "HelpBrowser" msgid "Found Documents" -msgstr "" +msgstr "Documents trobats" msgctxt "HelpBrowser" msgid "Error Loading Help Contents:" -msgstr "" +msgstr "Error mentre carregava els continguts d'ajuda" msgctxt "HelpTextBrowser" msgid "Opening External Link" -msgstr "" +msgstr "S'està obrint un enllaç extern" msgctxt "HelpTextBrowser" msgid "" @@ -1527,36 +1527,42 @@ msgid "" "browser is not currently configured to use Tor then the request will not be " "anonymous." msgstr "" +"Vidalia pot obrir l'enllaç que heu seleccionat en el seu navegador per " +"defecte. Si el vostre navegador no està actualment configurat per a " +"utilitzar el Tor, llavors la petició no podrà ser anònima" msgctxt "HelpTextBrowser" msgid "Do you want Vidalia to open the link in your Web browser?" -msgstr "" +msgstr "Desitgeu que Vidalia obri l'enllaç en el seu navegador web ?" msgctxt "HelpTextBrowser" msgid "Unable to Open Link" -msgstr "" +msgstr "Incapaç d'obrir l'enllaç" msgctxt "HelpTextBrowser" msgid "" "Vidalia was unable to open the selected link in your Web browser. You can " "still copy the URL and paste it into your browser." msgstr "" +"Vidalia ha estat incapaç d'obrir l'enllaç que heu seleccionat en el seu " +"navegador Web. De totes maneres, encara podeu copiar la URL i enganxar-la en" +" el vostre navegador web." msgctxt "HelpTextBrowser" msgid "Error opening help file:" -msgstr "" +msgstr "Error mentre s'obria el fitxer d'ajuda:" msgctxt "LicenseDialog" msgid "License Information" -msgstr "" +msgstr "Informació de la llicència" msgctxt "LicenseDialog" msgid "License" -msgstr "" +msgstr "Llicència" msgctxt "LicenseDialog" msgid "Credits" -msgstr "" +msgstr "Crèdits" msgctxt "LogEvent" msgid "Debug" @@ -1564,7 +1570,7 @@ msgstr "" msgctxt "LogEvent" msgid "Info" -msgstr "" +msgstr "Informació" msgctxt "LogEvent" msgid "Notice" @@ -1572,15 +1578,15 @@ msgstr "" msgctxt "LogEvent" msgid "Warning" -msgstr "" +msgstr "Avís" msgctxt "LogEvent" msgid "Error" -msgstr "" +msgstr "Error" msgctxt "LogEvent" msgid "Unknown" -msgstr "" +msgstr "Desconegut" msgctxt "LogTreeItem" msgid "Debug" @@ -1608,15 +1614,15 @@ msgstr "" msgctxt "MainWindow" msgid "Start Tor" -msgstr "" +msgstr "Arranca el Tor" msgctxt "MainWindow" msgid "Exit" -msgstr "" +msgstr "Surt" msgctxt "MainWindow" msgid "Bandwidth Graph" -msgstr "" +msgstr "Gràfica de l'amplada de banda" msgctxt "MainWindow" msgid "Message Log" @@ -1808,89 +1814,96 @@ msgstr "" msgctxt "MainWindow" msgid "Starting the Tor software" -msgstr "" +msgstr "S'està arrancant el programari Tor" msgctxt "MainWindow" msgid "Starting Tor" -msgstr "" +msgstr "S'està arrancant el Tor" msgctxt "MainWindow" msgid "Error Starting Tor" -msgstr "" +msgstr "Error mentre s'arrancava el Tor" msgctxt "MainWindow" msgid "" "Vidalia was unable to start Tor. Check your settings to ensure the correct " "name and location of your Tor executable is specified." msgstr "" +"Vidalia ha estat incapaç d'arrancar el Tor. Reviseu les vostres preferències" +" per a assegurar-vos que el nom és correcte i la ubicació de l'executable " +"del Tor està especificada." msgctxt "MainWindow" msgid "Connecting to Tor" -msgstr "" +msgstr "S'està connectant al Tor" msgctxt "MainWindow" msgid "Connection Error" -msgstr "" +msgstr "Error en la connexió" msgctxt "MainWindow" msgid "Relaying is Enabled" -msgstr "" +msgstr "El relaying està habilitat" msgctxt "MainWindow" msgid "Error Shutting Down" -msgstr "" +msgstr "Error mentre es tancava" msgctxt "MainWindow" msgid "Vidalia was unable to stop the Tor software." -msgstr "" +msgstr "Vidalia ha estat incapaç d'aturar el Tor." msgctxt "MainWindow" msgid "Unexpected Error" -msgstr "" +msgstr "Error imprevist" msgctxt "MainWindow" msgid "Authenticating to Tor" -msgstr "" +msgstr "S'està autenticant el Tor" msgctxt "MainWindow" msgid "Cookie Authentication Required" -msgstr "" +msgstr "Es requereix l'autenticació amb galetes" msgctxt "MainWindow" msgid "" "The Tor software requires Vidalia to send the contents of an authentication " "cookie, but Vidalia was unable to find one." msgstr "" +"El programari Tor requereix Vidalia per a trametre els continguts d'una " +"galeta d'autenticació, però Vidalia ha estat incapaç de trobar-ne cap." msgctxt "MainWindow" msgid "Would you like to browse for the file 'control_auth_cookie' yourself?" -msgstr "" +msgstr "Desitgeu navegar pel fitxer 'control_auth_cookie' vós mateix?" msgctxt "MainWindow" msgid "Data Directory" -msgstr "" +msgstr "Carpeta de dades" msgctxt "MainWindow" msgid "Control Cookie (control_auth_cookie)" -msgstr "" +msgstr "Control de galetes (control_auth_cookie)" msgctxt "MainWindow" msgid "Error Registering for Events" -msgstr "" +msgstr "Error mentre s'enregistraven els esdeveniments" msgctxt "MainWindow" msgid "" "Vidalia was unable to register for some events. Many of Vidalia's features " "may be unavailable." msgstr "" +"Vidalia ha estat incapaç d'entregistrar diversos esdeveniments. Moltes de " +"les característiques de Vidalia podrien no estar disponibles." msgctxt "MainWindow" msgid "Authentication Error" -msgstr "" +msgstr "Error d'autenticació" msgctxt "MainWindow" msgid "Vidalia was unable to authenticate to the Tor software. (%1)" -msgstr "" +msgstr "Vidalia ha estat incapaç d'autenticar-se amb el programari Tor. (%1)" msgctxt "MainWindow" msgid "Please check your control port authentication settings."

1 0

[translation/vidalia] Update translations for vidalia
by translation＠torproject.org 10 Jan '12

10 Jan '12

commit 3e741afac71143beddc8bbb0bcb676838b366c09 Author: Translation commit bot <translation(a)torproject.org> Date: Tue Jan 10 17:45:14 2012 +0000 Update translations for vidalia --- ca/vidalia_ca.po | 77 ++++++++++++++++++++++++++++-------------------------- 1 files changed, 40 insertions(+), 37 deletions(-) diff --git a/ca/vidalia_ca.po b/ca/vidalia_ca.po index 7804812..a2f3cbe 100755 --- a/ca/vidalia_ca.po +++ b/ca/vidalia_ca.po @@ -1,12 +1,13 @@ # # Translators: +# Gerard Farràs Ballabriga <>, 2012. msgid "" msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: https://trac.torproject.org/projects/tor\n" "POT-Creation-Date: 2011-09-07 14:40+0000\n" -"PO-Revision-Date: 2010-12-05 20:03+0000\n" -"Last-Translator: \n" +"PO-Revision-Date: 2012-01-10 17:43+0000\n" +"Last-Translator: Gerard Farràs Ballabriga <>\n" "Language-Team: translations(a)vidalia-project.net\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" @@ -17,32 +18,34 @@ msgstr "" msgctxt "AboutDialog" msgid "About Vidalia" -msgstr "" +msgstr "Quant a Vidalia" msgctxt "AboutDialog" msgid "License" -msgstr "" +msgstr "Llicència" msgctxt "AboutDialog" msgid "Vidalia 0.2.0" -msgstr "" +msgstr "Vidalia 0.2.0" msgctxt "AboutDialog" msgid "Tor 0.2.0.32" -msgstr "" +msgstr "Tor 0.2.0.32" msgctxt "AboutDialog" msgid "Qt 4.4.2" -msgstr "" +msgstr "Qt 4.4.2" msgctxt "AdvancedPage" msgid "'%1' is not a valid IP address." -msgstr "" +msgstr "%1 no és una adreça ip vàlida." msgctxt "AdvancedPage" msgid "" "You selected 'Password' authentication, but did not specify a password." msgstr "" +"Heu seleccionat autenticació amb 'Contrasenya', però no n'heu especificat " +"cap." msgctxt "AdvancedPage" msgid "Select Tor Configuration File" @@ -50,15 +53,15 @@ msgstr "" msgctxt "AdvancedPage" msgid "File Not Found" -msgstr "" +msgstr "Fitxer no trobat" msgctxt "AdvancedPage" msgid "%1 does not exist. Would you like to create it?" -msgstr "" +msgstr "%1 no existeix. El desitgeu crear ?" msgctxt "AdvancedPage" msgid "Failed to Create File" -msgstr "" +msgstr "Creació de fitxer fallida" msgctxt "AdvancedPage" msgid "Unable to create %1 [%2]" @@ -82,11 +85,11 @@ msgstr "" msgctxt "AdvancedPage" msgid "Authentication:" -msgstr "" +msgstr "Autenticació:" msgctxt "AdvancedPage" msgid "Address:" -msgstr "" +msgstr "Adreça:" msgctxt "AdvancedPage" msgid "None" @@ -94,27 +97,27 @@ msgstr "" msgctxt "AdvancedPage" msgid "Cookie" -msgstr "" +msgstr "Galeta" msgctxt "AdvancedPage" msgid "Password" -msgstr "" +msgstr "Contrasenya" msgctxt "AdvancedPage" msgid "Randomly Generate" -msgstr "" +msgstr "Generació aleatòria" msgctxt "AdvancedPage" msgid ":" -msgstr "" +msgstr ":" msgctxt "AdvancedPage" msgid "Tor Configuration File" -msgstr "" +msgstr "Fitxer de configuració del Tor" msgctxt "AdvancedPage" msgid "Start the Tor software with the specified configuration file (torrc)" -msgstr "" +msgstr "Arranca el Tor amb el fitxer de configuració especificat (torrc)" msgctxt "AdvancedPage" msgid "Select path to your configuration file" @@ -122,11 +125,11 @@ msgstr "" msgctxt "AdvancedPage" msgid "Browse" -msgstr "" +msgstr "Navega" msgctxt "AdvancedPage" msgid "Data Directory" -msgstr "" +msgstr "Directori de dades" msgctxt "AdvancedPage" msgid "Store data for the Tor software in the following directory" @@ -205,7 +208,7 @@ msgstr "" msgctxt "AppearancePage" msgid "Language" -msgstr "" +msgstr "Llengua" msgctxt "AppearancePage" msgid "Choose the language used in Vidalia" @@ -213,7 +216,7 @@ msgstr "" msgctxt "AppearancePage" msgid "Style" -msgstr "" +msgstr "Estil" msgctxt "AppearancePage" msgid "Choose Vidalia's interface style" @@ -225,23 +228,23 @@ msgstr "" msgctxt "BandwidthGraph" msgid "Since:" -msgstr "" +msgstr "Des de:" msgctxt "BandwidthGraph" msgid "Hide Settings" -msgstr "" +msgstr "Oculta les preferències" msgctxt "BandwidthGraph" msgid "Show Settings" -msgstr "" +msgstr "Mostra les preferències" msgctxt "BandwidthGraph" msgid "Tor Bandwidth Usage" -msgstr "" +msgstr "Ús de l'amplada de banda del Tor" msgctxt "BandwidthGraph" msgid "Reset" -msgstr "" +msgstr "Reinicia" msgctxt "BandwidthGraph" msgid "Receive Rate" @@ -253,11 +256,11 @@ msgstr "" msgctxt "BandwidthGraph" msgid "Always on Top" -msgstr "" +msgstr "Sempre visible" msgctxt "BandwidthGraph" msgid "Style" -msgstr "" +msgstr "Estil" msgctxt "BandwidthGraph" msgid "Changes the transparency of the Bandwidth Graph" @@ -265,19 +268,19 @@ msgstr "" msgctxt "BandwidthGraph" msgid "100" -msgstr "" +msgstr "100" msgctxt "BandwidthGraph" msgid "% Opaque" -msgstr "" +msgstr "% d'opacitat" msgctxt "BandwidthGraph" msgid "Save" -msgstr "" +msgstr "Desa" msgctxt "BandwidthGraph" msgid "Cancel" -msgstr "" +msgstr "Cancel·la" msgctxt "BridgeDownloader" msgid "Starting HTTPS bridge request..." @@ -421,7 +424,7 @@ msgstr "" msgctxt "ConfigDialog" msgid "Settings" -msgstr "" +msgstr "Preferències" msgctxt "ControlConnection" msgid "Vidalia was unable to connect to Tor. (%1)" @@ -433,11 +436,11 @@ msgstr "" msgctxt "ControlPasswordInputDialog" msgid "Password Required" -msgstr "" +msgstr "Contrasenya requerida" msgctxt "ControlPasswordInputDialog" msgid "Remember my password" -msgstr "" +msgstr "Recorda la meva contrasenya" msgctxt "ControlPasswordInputDialog" msgid ""

1 0

[tor/master] Test for broken counter-mode at runtime
by nickm＠torproject.org 10 Jan '12

10 Jan '12

commit d29a3907338bd012ce5707e0e052747da87b3ba4 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jan 9 17:40:11 2012 -0500 Test for broken counter-mode at runtime To solve bug 4779, we want to avoid OpenSSL 1.0.0's counter mode. But Fedora (and maybe others) lie about the actual OpenSSL version, so we can't trust the header to tell us if it's safe. Instead, let's do a run-time test to see whether it's safe, and if not, use our built-in version. fermenthor contributed a pretty essential fixup to this patch. Thanks! --- changes/aes_ctr_test | 5 ++ src/common/aes.c | 141 +++++++++++++++++++++++++++++++++--------------- src/common/aes.h | 1 + src/common/crypto.c | 1 + src/test/test_crypto.c | 1 + 5 files changed, 106 insertions(+), 43 deletions(-) diff --git a/changes/aes_ctr_test b/changes/aes_ctr_test new file mode 100644 index 0000000..8b5af45 --- /dev/null +++ b/changes/aes_ctr_test @@ -0,0 +1,5 @@ + o Minor bugfixes + - Test for the OpenSSL 1.0.0 counter mode bug at runtime, not compile + time. This is necessary because OpenSSL has been hacked to mis-report + its version on a few distributions. + Bugfix on Tor 0.2.3.11-alpha. diff --git a/src/common/aes.c b/src/common/aes.c index 5791e66..f6288e8 100644 --- a/src/common/aes.c +++ b/src/common/aes.c @@ -18,10 +18,10 @@ #include <openssl/evp.h> #include <openssl/engine.h> #include "crypto.h" -#if OPENSSL_VERSION_NUMBER >= OPENSSL_V(1,0,0,'a') +#if OPENSSL_VERSION_NUMBER >= OPENSSL_V_SERIES(1,0,0) /* See comments about which counter mode implementation to use below. */ #include <openssl/modes.h> -#define USE_OPENSSL_CTR +#define CAN_USE_OPENSSL_CTR #endif #include "compat.h" #include "aes.h" @@ -62,7 +62,7 @@ struct aes_cnt_cipher { AES_KEY aes; } key; -#if !defined(WORDS_BIGENDIAN) && !defined(USE_OPENSSL_CTR) +#if !defined(WORDS_BIGENDIAN) #define USING_COUNTER_VARS /** These four values, together, implement a 128-bit counter, with * counter0 as the low-order word and counter3 as the high-order word. */ @@ -84,11 +84,7 @@ struct aes_cnt_cipher { /** The encrypted value of ctr_buf. */ uint8_t buf[16]; /** Our current stream position within buf. */ -#ifdef USE_OPENSSL_CTR unsigned int pos; -#else - uint8_t pos; -#endif /** True iff we're using the evp implementation of this cipher. */ uint8_t using_evp; @@ -98,6 +94,11 @@ struct aes_cnt_cipher { * we're testing it or because we have hardware acceleration configured */ static int should_use_EVP = 0; +#ifdef CAN_USE_OPENSSL_CTR +/**DOCDOC*/ +static int should_use_openssl_CTR = 0; +#endif + /** Check whether we should use the EVP interface for AES. If force_val * is nonnegative, we use use EVP iff it is true. Otherwise, we use EVP * if there is an engine enabled for aes-ecb. */ @@ -128,7 +129,50 @@ evaluate_evp_for_aes(int force_val) return 0; } -#ifndef USE_OPENSSL_CTR +/**DOCDOC*/ +int +evaluate_ctr_for_aes(void) +{ +#ifdef CAN_USE_OPENSSL_CTR + /* Result of encrypting an all-zero block with an all-zero 128-bit AES key. + * This should be the same as encrypting an all-zero block with an all-zero + * 128-bit AES key in counter mode, starting at position 0 of the stream. + */ + static const unsigned char encrypt_zero[] = + "\x66\xe9\x4b\xd4\xef\x8a\x2c\x3b\x88\x4c\xfa\x59\xca\x34\x2b\x2e"; + unsigned char zero[16]; + unsigned char output[16]; + unsigned char ivec[16]; + unsigned char ivec_tmp[16]; + unsigned int pos, i; + AES_KEY key; + memset(zero, 0, sizeof(zero)); + memset(ivec, 0, sizeof(ivec)); + AES_set_encrypt_key(zero, 128, &key); + + pos = 0; + /* Encrypting a block one byte at a time should make the error manifest + * itself for known bogus openssl versions. */ + for (i=0; i<16; ++i) + AES_ctr128_encrypt(&zero[i], &output[i], 1, &key, ivec, ivec_tmp, &pos); + + if (memcmp(output, encrypt_zero, 16)) { + /* Counter mode is buggy */ + log_notice(LD_CRYPTO, "This OpenSSL has a buggy version of counter mode; " + "not using it."); + } else { + /* Counter mode is okay */ + log_notice(LD_CRYPTO, "This OpenSSL has a good implementation of counter " + "mode; using it."); + should_use_openssl_CTR = 1; + } +#else + log_notice(LD_CRYPTO, "This version of OpenSSL has a slow implementation of " + "counter mode; not using it."); +#endif + return 0; +} + #if !defined(USING_COUNTER_VARS) #define COUNTER(c, n) ((c)->ctr_buf.buf32[3-(n)]) #else @@ -157,7 +201,6 @@ _aes_fill_buf(aes_cnt_cipher_t *cipher) AES_encrypt(cipher->ctr_buf.buf, cipher->buf, &cipher->key.aes); } } -#endif /** * Return a newly allocated counter-mode AES128 cipher implementation. @@ -203,11 +246,12 @@ aes_set_key(aes_cnt_cipher_t *cipher, const char *key, int key_bits) cipher->pos = 0; -#ifdef USE_OPENSSL_CTR - memset(cipher->buf, 0, sizeof(cipher->buf)); -#else - _aes_fill_buf(cipher); +#ifdef CAN_USE_OPENSSL_CTR + if (should_use_openssl_CTR) + memset(cipher->buf, 0, sizeof(cipher->buf)); + else #endif + _aes_fill_buf(cipher); } /** Release storage held by cipher @@ -232,7 +276,7 @@ aes_free_cipher(aes_cnt_cipher_t *cipher) #define UPDATE_CTR_BUF(c, n) #endif -#ifdef USE_OPENSSL_CTR +#ifdef CAN_USE_OPENSSL_CTR /* Helper function to use EVP with openssl's counter-mode wrapper. */ static void evp_block128_fn(const uint8_t in[16], uint8_t out[16], @@ -252,29 +296,34 @@ void aes_crypt(aes_cnt_cipher_t *cipher, const char *input, size_t len, char *output) { -#ifdef USE_OPENSSL_CTR - if (cipher->using_evp) { - /* In openssl 1.0.0, there's an if'd out EVP_aes_128_ctr in evp.h. If - * it weren't disabled, it might be better just to use that. - */ - CRYPTO_ctr128_encrypt((const unsigned char *)input, - (unsigned char *)output, - len, - &cipher->key.evp, - cipher->ctr_buf.buf, - cipher->buf, - &cipher->pos, - evp_block128_fn); - } else { - AES_ctr128_encrypt((const unsigned char *)input, - (unsigned char *)output, - len, - &cipher->key.aes, - cipher->ctr_buf.buf, - cipher->buf, - &cipher->pos); +#ifdef CAN_USE_OPENSSL_CTR + if (should_use_openssl_CTR) { + if (cipher->using_evp) { + /* In openssl 1.0.0, there's an if'd out EVP_aes_128_ctr in evp.h. If + * it weren't disabled, it might be better just to use that. + */ + CRYPTO_ctr128_encrypt((const unsigned char *)input, + (unsigned char *)output, + len, + &cipher->key.evp, + cipher->ctr_buf.buf, + cipher->buf, + &cipher->pos, + evp_block128_fn); + } else { + AES_ctr128_encrypt((const unsigned char *)input, + (unsigned char *)output, + len, + &cipher->key.aes, + cipher->ctr_buf.buf, + cipher->buf, + &cipher->pos); + } + return; } -#else + else +#endif + { int c = cipher->pos; if (PREDICT_UNLIKELY(!len)) return; @@ -297,7 +346,7 @@ aes_crypt(aes_cnt_cipher_t *cipher, const char *input, size_t len, UPDATE_CTR_BUF(cipher, 0); _aes_fill_buf(cipher); } -#endif + } } /** Encrypt len bytes from input, storing the results in place. @@ -307,9 +356,14 @@ aes_crypt(aes_cnt_cipher_t *cipher, const char *input, size_t len, void aes_crypt_inplace(aes_cnt_cipher_t *cipher, char *data, size_t len) { -#ifdef USE_OPENSSL_CTR - aes_crypt(cipher, data, len, data); -#else +#ifdef CAN_USE_OPENSSL_CTR + if (should_use_openssl_CTR) { + aes_crypt(cipher, data, len, data); + return; + } + else +#endif + { int c = cipher->pos; if (PREDICT_UNLIKELY(!len)) return; @@ -332,7 +386,7 @@ aes_crypt_inplace(aes_cnt_cipher_t *cipher, char *data, size_t len) UPDATE_CTR_BUF(cipher, 0); _aes_fill_buf(cipher); } -#endif + } } /** Reset the 128-bit counter of cipher to the 16-bit big-endian value @@ -349,8 +403,9 @@ aes_set_iv(aes_cnt_cipher_t *cipher, const char *iv) cipher->pos = 0; memcpy(cipher->ctr_buf.buf, iv, 16); -#ifndef USE_OPENSSL_CTR - _aes_fill_buf(cipher); +#ifdef CAN_USE_OPENSSL_CTR + if (!should_use_openssl_CTR) #endif + _aes_fill_buf(cipher); } diff --git a/src/common/aes.h b/src/common/aes.h index 221e846..f7f0319 100644 --- a/src/common/aes.h +++ b/src/common/aes.h @@ -25,6 +25,7 @@ void aes_crypt_inplace(aes_cnt_cipher_t *cipher, char *data, size_t len); void aes_set_iv(aes_cnt_cipher_t *cipher, const char *iv); int evaluate_evp_for_aes(int force_value); +int evaluate_ctr_for_aes(void); #endif diff --git a/src/common/crypto.c b/src/common/crypto.c index 35d6dfa..364b6a7 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -281,6 +281,7 @@ crypto_global_init(int useAccel, const char *accelName, const char *accelDir) } evaluate_evp_for_aes(-1); + evaluate_ctr_for_aes(); return crypto_seed_rng(1); } diff --git a/src/test/test_crypto.c b/src/test/test_crypto.c index cad8c2f..2adbcc9 100644 --- a/src/test/test_crypto.c +++ b/src/test/test_crypto.c @@ -105,6 +105,7 @@ test_crypto_aes(void *arg) int use_evp = !strcmp(arg,"evp"); evaluate_evp_for_aes(use_evp); + evaluate_ctr_for_aes(); data1 = tor_malloc(1024); data2 = tor_malloc(1024);

1 0

[tor/master] Clean up indentation in aes.c
by nickm＠torproject.org 10 Jan '12

10 Jan '12

commit cc5c14b7327924e7136f8709d69cf23761ab7a44 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jan 10 10:07:33 2012 -0500 Clean up indentation in aes.c --- src/common/aes.c | 76 +++++++++++++++++++++++++++--------------------------- 1 files changed, 38 insertions(+), 38 deletions(-) diff --git a/src/common/aes.c b/src/common/aes.c index f6288e8..3c315dc 100644 --- a/src/common/aes.c +++ b/src/common/aes.c @@ -324,28 +324,28 @@ aes_crypt(aes_cnt_cipher_t *cipher, const char *input, size_t len, else #endif { - int c = cipher->pos; - if (PREDICT_UNLIKELY(!len)) return; - - while (1) { - do { - if (len-- == 0) { cipher->pos = c; return; } - *(output++) = *(input++) ^ cipher->buf[c]; - } while (++c != 16); - cipher->pos = c = 0; - if (PREDICT_UNLIKELY(! ++COUNTER(cipher, 0))) { - if (PREDICT_UNLIKELY(! ++COUNTER(cipher, 1))) { - if (PREDICT_UNLIKELY(! ++COUNTER(cipher, 2))) { - ++COUNTER(cipher, 3); - UPDATE_CTR_BUF(cipher, 3); + int c = cipher->pos; + if (PREDICT_UNLIKELY(!len)) return; + + while (1) { + do { + if (len-- == 0) { cipher->pos = c; return; } + *(output++) = *(input++) ^ cipher->buf[c]; + } while (++c != 16); + cipher->pos = c = 0; + if (PREDICT_UNLIKELY(! ++COUNTER(cipher, 0))) { + if (PREDICT_UNLIKELY(! ++COUNTER(cipher, 1))) { + if (PREDICT_UNLIKELY(! ++COUNTER(cipher, 2))) { + ++COUNTER(cipher, 3); + UPDATE_CTR_BUF(cipher, 3); + } + UPDATE_CTR_BUF(cipher, 2); } - UPDATE_CTR_BUF(cipher, 2); + UPDATE_CTR_BUF(cipher, 1); } - UPDATE_CTR_BUF(cipher, 1); + UPDATE_CTR_BUF(cipher, 0); + _aes_fill_buf(cipher); } - UPDATE_CTR_BUF(cipher, 0); - _aes_fill_buf(cipher); - } } } @@ -364,28 +364,28 @@ aes_crypt_inplace(aes_cnt_cipher_t *cipher, char *data, size_t len) else #endif { - int c = cipher->pos; - if (PREDICT_UNLIKELY(!len)) return; - - while (1) { - do { - if (len-- == 0) { cipher->pos = c; return; } - *(data++) ^= cipher->buf[c]; - } while (++c != 16); - cipher->pos = c = 0; - if (PREDICT_UNLIKELY(! ++COUNTER(cipher, 0))) { - if (PREDICT_UNLIKELY(! ++COUNTER(cipher, 1))) { - if (PREDICT_UNLIKELY(! ++COUNTER(cipher, 2))) { - ++COUNTER(cipher, 3); - UPDATE_CTR_BUF(cipher, 3); + int c = cipher->pos; + if (PREDICT_UNLIKELY(!len)) return; + + while (1) { + do { + if (len-- == 0) { cipher->pos = c; return; } + *(data++) ^= cipher->buf[c]; + } while (++c != 16); + cipher->pos = c = 0; + if (PREDICT_UNLIKELY(! ++COUNTER(cipher, 0))) { + if (PREDICT_UNLIKELY(! ++COUNTER(cipher, 1))) { + if (PREDICT_UNLIKELY(! ++COUNTER(cipher, 2))) { + ++COUNTER(cipher, 3); + UPDATE_CTR_BUF(cipher, 3); + } + UPDATE_CTR_BUF(cipher, 2); } - UPDATE_CTR_BUF(cipher, 2); + UPDATE_CTR_BUF(cipher, 1); } - UPDATE_CTR_BUF(cipher, 1); + UPDATE_CTR_BUF(cipher, 0); + _aes_fill_buf(cipher); } - UPDATE_CTR_BUF(cipher, 0); - _aes_fill_buf(cipher); - } } }

1 0

[tor/master] Add missing documentation for counter-mode checks
by nickm＠torproject.org 10 Jan '12

10 Jan '12

commit dca3c9fff87227b8119afe804ce0ae8ed840b1f8 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jan 10 11:13:45 2012 -0500 Add missing documentation for counter-mode checks --- src/common/aes.c | 17 ++++++++++++----- 1 files changed, 12 insertions(+), 5 deletions(-) diff --git a/src/common/aes.c b/src/common/aes.c index 3c315dc..da7220f 100644 --- a/src/common/aes.c +++ b/src/common/aes.c @@ -47,8 +47,8 @@ * OpenSSL pre-1.0 (by about 10%!). But OpenSSL 1.0.0 added a counter mode * implementation faster than the one here (by about 7%). So we pick which * one to used based on the Openssl version above. (OpenSSL 1.0.0a fixed a - * critical bug in that counter mode implementation, so we actually require - * that one.) + * critical bug in that counter mode implementation, so we need to test to + * make sure that we have a fixed version.) */ /*======================================================================*/ @@ -90,12 +90,13 @@ struct aes_cnt_cipher { uint8_t using_evp; }; -/** True if we should prefer the EVP implementation for AES, either because +/** True iff we should prefer the EVP implementation for AES, either because * we're testing it or because we have hardware acceleration configured */ static int should_use_EVP = 0; #ifdef CAN_USE_OPENSSL_CTR -/**DOCDOC*/ +/** True iff we have tested the counter-mode implementation and found that it + * doesn't have the counter-mode bug from OpenSSL 1.0.0. */ static int should_use_openssl_CTR = 0; #endif @@ -129,7 +130,13 @@ evaluate_evp_for_aes(int force_val) return 0; } -/**DOCDOC*/ +/** Test the OpenSSL counter mode implementation to see whether it has the + * counter-mode bug from OpenSSL 1.0.0. If the implementation works, then + * we will use it for future encryption/decryption operations. + * + * We can't just look at the OpenSSL version, since some distributions update + * their OpenSSL packages without changing the version number. + **/ int evaluate_ctr_for_aes(void) {

1 0

[tor/master] We no longer need to detect openssl without RAND_poll()
by nickm＠torproject.org 10 Jan '12

10 Jan '12

commit 5741aef3dc0dc245ab930c21b277a5a829c9970d Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jan 5 15:08:05 2012 -0500 We no longer need to detect openssl without RAND_poll() We require openssl 0.9.7 or later, and RAND_poll() was first added in openssl 0.9.6. --- changes/readable_ssl_versions | 2 ++ src/common/crypto.c | 10 +--------- 2 files changed, 3 insertions(+), 9 deletions(-) diff --git a/changes/readable_ssl_versions b/changes/readable_ssl_versions index 8c8e06c..f34998c 100644 --- a/changes/readable_ssl_versions +++ b/changes/readable_ssl_versions @@ -1,4 +1,6 @@ o Code simplification and refactoring: - Use macros to indicate OpenSSL versions, so we don't need to worry about accidental hexadecimal bit shifts. + - Remove some workaround code for OpenSSL 0.9.6, which is no longer + supported. diff --git a/src/common/crypto.c b/src/common/crypto.c index aa8ceed..35d6dfa 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -2360,12 +2360,6 @@ crypto_dh_free(crypto_dh_env_t *dh) * work for us too. */ #define ADD_ENTROPY 32 -/** True iff we should use OpenSSL's RAND_poll function to add entropy to its - * pool. - * - * Use RAND_poll if OpenSSL is 0.9.6 release or later. */ -#define HAVE_RAND_POLL (OPENSSL_VERSION_NUMBER >= OPENSSL_V_NOPATCH(0,9,6)) - /** True iff it's safe to use RAND_poll after setup. * * Versions of OpenSSL prior to 0.9.7k and 0.9.8c had a bug where RAND_poll @@ -2409,8 +2403,7 @@ crypto_seed_rng(int startup) size_t n; #endif -#if HAVE_RAND_POLL - /* OpenSSL 0.9.6 adds a RAND_poll function that knows about more kinds of + /* OpenSSL has a RAND_poll function that knows about more kinds of * entropy than we do. We'll try calling that, *and* calling our own entropy * functions. If one succeeds, we'll accept the RNG as seeded. */ if (startup || RAND_POLL_IS_SAFE) { @@ -2418,7 +2411,6 @@ crypto_seed_rng(int startup) if (rand_poll_status == 0) log_warn(LD_CRYPTO, "RAND_poll() failed."); } -#endif #ifdef MS_WINDOWS if (!provider_set) {

1 0

[tor/master] Add macros to construct openssl version numbers
by nickm＠torproject.org 10 Jan '12

10 Jan '12

commit 85c7d7659ea1b9c99c13596e943260ad2e396483 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jan 5 15:05:17 2012 -0500 Add macros to construct openssl version numbers It's a pain to convert 0x0090813f to and from 0.9.8s-release on the fly, so these macros should help. --- changes/readable_ssl_versions | 4 ++++ src/common/aes.c | 3 ++- src/common/crypto.c | 19 +++++++++---------- src/common/crypto.h | 32 ++++++++++++++++++++++++++++++++ src/common/tortls.c | 28 ++++++++++++++-------------- 5 files changed, 61 insertions(+), 25 deletions(-) diff --git a/changes/readable_ssl_versions b/changes/readable_ssl_versions new file mode 100644 index 0000000..8c8e06c --- /dev/null +++ b/changes/readable_ssl_versions @@ -0,0 +1,4 @@ + o Code simplification and refactoring: + - Use macros to indicate OpenSSL versions, so we don't need to worry + about accidental hexadecimal bit shifts. + diff --git a/src/common/aes.c b/src/common/aes.c index 9487cdd..5791e66 100644 --- a/src/common/aes.c +++ b/src/common/aes.c @@ -17,7 +17,8 @@ #include <openssl/aes.h> #include <openssl/evp.h> #include <openssl/engine.h> -#if OPENSSL_VERSION_NUMBER >= 0x1000001fL +#include "crypto.h" +#if OPENSSL_VERSION_NUMBER >= OPENSSL_V(1,0,0,'a') /* See comments about which counter mode implementation to use below. */ #include <openssl/modes.h> #define USE_OPENSSL_CTR diff --git a/src/common/crypto.c b/src/common/crypto.c index d1d823d..aa8ceed 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -60,7 +60,7 @@ #include "container.h" #include "compat.h" -#if OPENSSL_VERSION_NUMBER < 0x00907000l +#if OPENSSL_VERSION_NUMBER < OPENSSL_V_SERIES(0,9,7) #error "We require OpenSSL >= 0.9.7" #endif @@ -72,7 +72,7 @@ /** Longest recognized */ #define MAX_DNS_LABEL_SIZE 63 -#if OPENSSL_VERSION_NUMBER < 0x00908000l +#if OPENSSL_VERSION_NUMBER < OPENSSL_V_SERIES(0,9,8) /** @{ */ /** On OpenSSL versions before 0.9.8, there is no working SHA256 * implementation, so we use Tom St Denis's nice speedy one, slightly adapted @@ -452,7 +452,7 @@ crypto_pk_generate_key_with_bits(crypto_pk_env_t *env, int bits) if (env->key) RSA_free(env->key); -#if OPENSSL_VERSION_NUMBER < 0x00908000l +#if OPENSSL_VERSION_NUMBER < OPENSSL_V_SERIES(0,9,8) /* In OpenSSL 0.9.7, RSA_generate_key is all we have. */ env->key = RSA_generate_key(bits, 65537, NULL, NULL); #else @@ -1723,7 +1723,7 @@ crypto_hmac_sha256(char *hmac_out, const char *key, size_t key_len, const char *msg, size_t msg_len) { -#if (OPENSSL_VERSION_NUMBER >= 0x00908000l) +#if OPENSSL_VERSION_NUMBER >= OPENSSL_V_SERIES(0,9,8) /* If we've got OpenSSL >=0.9.8 we can use its hmac implementation. */ tor_assert(key_len < INT_MAX); tor_assert(msg_len < INT_MAX); @@ -2363,9 +2363,8 @@ crypto_dh_free(crypto_dh_env_t *dh) /** True iff we should use OpenSSL's RAND_poll function to add entropy to its * pool. * - * Use RAND_poll if OpenSSL is 0.9.6 release or later. (The "f" means - *"release".) */ -#define HAVE_RAND_POLL (OPENSSL_VERSION_NUMBER >= 0x0090600fl) + * Use RAND_poll if OpenSSL is 0.9.6 release or later. */ +#define HAVE_RAND_POLL (OPENSSL_VERSION_NUMBER >= OPENSSL_V_NOPATCH(0,9,6)) /** True iff it's safe to use RAND_poll after setup. * @@ -2374,9 +2373,9 @@ crypto_dh_free(crypto_dh_env_t *dh) * that fd without checking whether it fit in the fd_set. Thus, if the * system has not just been started up, it is unsafe to call */ #define RAND_POLL_IS_SAFE \ - ((OPENSSL_VERSION_NUMBER >= 0x009070afl && \ - OPENSSL_VERSION_NUMBER <= 0x00907fffl) || \ - (OPENSSL_VERSION_NUMBER >= 0x0090803fl)) + ((OPENSSL_VERSION_NUMBER >= OPENSSL_V(0,9,7,'j') && \ + OPENSSL_VERSION_NUMBER < OPENSSL_V_SERIES(0,9,8)) || \ + OPENSSL_VERSION_NUMBER >= OPENSSL_V(0,9,8,'c')) /** Set the seed of the weak RNG to a random value. */ static void diff --git a/src/common/crypto.h b/src/common/crypto.h index 771c49c..4783654 100644 --- a/src/common/crypto.h +++ b/src/common/crypto.h @@ -16,6 +16,38 @@ #include <stdio.h> #include "torint.h" +/* + Macro to create an arbitrary OpenSSL version number as used by + OPENSSL_VERSION_NUMBER or SSLeay(), since the actual numbers are a bit hard + to read. + + Don't use this directly, instead use one of the other OPENSSL_V macros + below. + + The format is: 4 bits major, 8 bits minor, 8 bits fix, 8 bits patch, 4 bit + status. + */ +#define OPENSSL_VER(a,b,c,d,e) \ + (((a)<<28) | \ + ((b)<<20) | \ + ((c)<<12) | \ + ((d)<< 4) | \ + (e)) +/** An openssl release number. For example, OPENSSL_V(0,9,8,'j') is the + * version for the released version of 0.9.8j */ +#define OPENSSL_V(a,b,c,d) \ + OPENSSL_VER((a),(b),(c),(d)-'a'+1,0xf) +/** An openssl release number for the first release in the series. For + * example, OPENSSL_V_NOPATCH(1,0,0) is the first released version of OpenSSL + * 1.0.0. */ +#define OPENSSL_V_NOPATCH(a,b,c) \ + OPENSSL_VER((a),(b),(c),0,0xf) +/** The first version that would occur for any alpha or beta in an openssl + * series. For example, OPENSSL_V_SERIES(0,9,8) is greater than any released + * 0.9.7, and less than any released 0.9.8. */ +#define OPENSSL_V_SERIES(a,b,c) \ + OPENSSL_VER((a),(b),(c),0,0) + /** Length of the output of our message digest. */ #define DIGEST_LEN 20 /** Length of the output of our second (improved) message digests. (For now diff --git a/src/common/tortls.c b/src/common/tortls.c index 832f744..834e5f1 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -44,10 +44,6 @@ #include <openssl/bio.h> #include <openssl/opensslv.h> -#if OPENSSL_VERSION_NUMBER < 0x00907000l -#error "We require OpenSSL >= 0.9.7" -#endif - #ifdef USE_BUFFEREVENTS #include <event2/bufferevent_ssl.h> #include <event2/buffer.h> @@ -65,6 +61,10 @@ #include "container.h" #include <string.h> +#if OPENSSL_VERSION_NUMBER < OPENSSL_V_SERIES(0,9,7) +#error "We require OpenSSL >= 0.9.7" +#endif + /* Enable the "v2" TLS handshake. */ #define V2_HANDSHAKE_SERVER @@ -79,9 +79,9 @@ #define ADDR(tls) (((tls) && (tls)->address) ? tls->address : "peer") -#if (OPENSSL_VERSION_NUMBER < 0x0090813fL || \ - (OPENSSL_VERSION_NUMBER >= 0x00909000L && \ - OPENSSL_VERSION_NUMBER < 0x1000006fL)) +#if (OPENSSL_VERSION_NUMBER < OPENSSL_V(0,9,8,'s') || \ + (OPENSSL_VERSION_NUMBER >= OPENSSL_V_SERIES(0,9,9) && \ + OPENSSL_VERSION_NUMBER < OPENSSL_V(1,0,0,'f'))) /* This is a version of OpenSSL before 0.9.8s/1.0.0f. It does not have * the CVE-2011-4657 fix, and as such it can't use RELEASE_BUFFERS and * SSL3 safely at the same time. @@ -474,18 +474,18 @@ tor_tls_init(void) * program should be allowed to use renegotiation unless it first passed * a test of intelligence and determination. */ - if (version >= 0x009080c0L && version < 0x009080d0L) { + if (version > OPENSSL_V(0,9,8,'k') && version <= OPENSSL_V(0,9,8,'l')) { log_notice(LD_GENERAL, "OpenSSL %s looks like version 0.9.8l; " "I will try SSL3_FLAGS to enable renegotation.", SSLeay_version(SSLEAY_VERSION)); use_unsafe_renegotiation_flag = 1; use_unsafe_renegotiation_op = 1; - } else if (version >= 0x009080d0L) { + } else if (version > OPENSSL_V(0,9,8,'l')) { log_notice(LD_GENERAL, "OpenSSL %s looks like version 0.9.8m or later; " "I will try SSL_OP to enable renegotiation", SSLeay_version(SSLEAY_VERSION)); use_unsafe_renegotiation_op = 1; - } else if (version < 0x009080c0L) { + } else if (version <= OPENSSL_V(0,9,8,'k')) { log_notice(LD_GENERAL, "OpenSSL %s [%lx] looks like it's older than " "0.9.8l, but some vendors have backported 0.9.8l's " "renegotiation code to earlier versions, and some have " @@ -770,7 +770,7 @@ tor_cert_decode(const uint8_t *certificate, size_t certificate_len) if (certificate_len > INT_MAX) return NULL; -#if OPENSSL_VERSION_NUMBER < 0x00908000l +#if OPENSSL_VERSION_NUMBER < OPENSSL_V_SERIES(0,9,8) /* This ifdef suppresses a type warning. Take out this case once everybody * is using OpenSSL 0.9.8 or later. */ x509 = d2i_X509(NULL, (unsigned char**)&cp, (int)certificate_len); @@ -1177,9 +1177,9 @@ tor_tls_context_new(crypto_pk_env_t *identity, unsigned int key_lifetime, #ifdef DISABLE_SSL3_HANDSHAKE 1 || #endif - SSLeay() < 0x0090813fL || - (SSLeay() >= 0x00909000L && - SSLeay() < 0x1000006fL)) { + SSLeay() < OPENSSL_V(0,9,8,'s') || + (SSLeay() >= OPENSSL_V_SERIES(0,9,9) && + SSLeay() < OPENSSL_V(1,0,0,'f'))) { /* And not SSL3 if it's subject to CVE-2011-4657. */ log_info(LD_NET, "Disabling SSLv3 because this OpenSSL version " "might otherwise be vulnerable to CVE-2011-4657 "

1 0

[tor/master] Merge branch 'openssl_versions_squashed'
by nickm＠torproject.org 10 Jan '12

10 Jan '12

commit b443d6a4fbfaac8d4a944d8b2a763666d1683ada Merge: 6b9298e 5741aef Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jan 10 10:41:03 2012 -0500 Merge branch 'openssl_versions_squashed' changes/readable_ssl_versions | 6 ++++++ src/common/aes.c | 3 ++- src/common/crypto.c | 25 ++++++++----------------- src/common/crypto.h | 32 ++++++++++++++++++++++++++++++++ src/common/tortls.c | 28 ++++++++++++++-------------- 5 files changed, 62 insertions(+), 32 deletions(-)

1 0

[tor/master] Log which votes we still need to fetch
by nickm＠torproject.org 10 Jan '12

10 Jan '12

commit 6b9298ef72997c1cd0ed2e9c47abeb6c06f64f9f Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Tue Jan 10 16:12:22 2012 +0100 Log which votes we still need to fetch This might help us see which authorities are problematic in getting their vote published the first time. --- changes/dirauth_log | 3 +++ src/or/dirvote.c | 9 +++++++-- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/changes/dirauth_log b/changes/dirauth_log new file mode 100644 index 0000000..df82314 --- /dev/null +++ b/changes/dirauth_log @@ -0,0 +1,3 @@ + o Minor features: + - Log which authority we're missing votes from when we go to fetch them + from the other auths. diff --git a/src/or/dirvote.c b/src/or/dirvote.c index 2843336..3bb165a 100644 --- a/src/or/dirvote.c +++ b/src/or/dirvote.c @@ -2801,8 +2801,13 @@ dirvote_fetch_missing_votes(void) smartlist_free(missing_fps); return; } - log_notice(LOG_NOTICE, "We're missing votes from %d authorities. Asking " - "every other authority for a copy.", smartlist_len(missing_fps)); + { + char *tmp = smartlist_join_strings(missing_fps, " ", 0, NULL); + log_notice(LOG_NOTICE, "We're missing votes from %d authorities (%s). " + "Asking every other authority for a copy.", + smartlist_len(missing_fps), tmp); + tor_free(tmp); + } resource = smartlist_join_strings(missing_fps, "+", 0, NULL); directory_get_from_all_authorities(DIR_PURPOSE_FETCH_STATUS_VOTE, 0, resource);

1 0