- tor-commits - lists.torproject.org

[tor/master] Set torrc_fname in load_torrc_from_disk
by nickm＠torproject.org 30 Nov '11

30 Nov '11

commit 4150d92eea48ddf44c001b0c87833b0101051d3e Author: Robert Ransom <rransom.8774(a)gmail.com> Date: Tue Nov 29 17:11:49 2011 -0800 Set torrc_fname in load_torrc_from_disk Bugfix on commit 230422b955e1708f27f42cdd25e8b21a33fdd3dd, not yet in any release. Fixes bug #4604; reported by koolfy. --- src/or/config.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/or/config.c b/src/or/config.c index f0686da..e92b01d 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -4385,7 +4385,7 @@ load_torrc_from_disk(int argc, char **argv, int defaults_file) char *cf = NULL; int using_default_torrc = 1; int ignore_missing_torrc = 0; - char **fname_var = defaults_file ? &torrc_fname : &torrc_defaults_fname; + char **fname_var = defaults_file ? &torrc_defaults_fname : &torrc_fname; fname = find_torrc_filename(argc, argv, defaults_file, &using_default_torrc, &ignore_missing_torrc);

1 0

[tor/master] Add 'config-defaults-file' to getinfo_items table
by nickm＠torproject.org 30 Nov '11

30 Nov '11

commit e70610878afe63f5c58798edf3648e0cb54b157a Author: Robert Ransom <rransom.8774(a)gmail.com> Date: Tue Nov 29 17:13:39 2011 -0800 Add 'config-defaults-file' to getinfo_items table Bugfix on commit 230422b955e1708f27f42cdd25e8b21a33fdd3dd, not yet in any release; fixes bug #4605. --- src/or/control.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/src/or/control.c b/src/or/control.c index 8d924b4..e2d0eec 100644 --- a/src/or/control.c +++ b/src/or/control.c @@ -2026,6 +2026,7 @@ typedef struct getinfo_item_t { static const getinfo_item_t getinfo_items[] = { ITEM("version", misc, "The current version of Tor."), ITEM("config-file", misc, "Current location of the \"torrc\" file."), + ITEM("config-defaults-file", misc, "Current location of the defaults file."), ITEM("config-text", misc, "Return the string that would be written by a saveconf command."), ITEM("accounting/bytes", accounting,

1 0

[tor/master] Merge remote-tracking branch 'rransom-tor/bug4605'
by nickm＠torproject.org 30 Nov '11

30 Nov '11

commit fdc0aa8c458f13c3a5ad65e680326119c1e26ac1 Merge: 8bb23c7 e706108 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Nov 29 20:28:08 2011 -0500 Merge remote-tracking branch 'rransom-tor/bug4605' src/or/config.c | 2 +- src/or/control.c | 1 + 2 files changed, 2 insertions(+), 1 deletions(-)

1 0

[tor/master] Merge branch 'bug4587_v2'
by nickm＠torproject.org 30 Nov '11

30 Nov '11

commit 8bb23c7def49e5a090d337e56eee8398261d9fb6 Merge: e718397 e27a26d Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Nov 29 19:15:40 2011 -0500 Merge branch 'bug4587_v2' src/common/tortls.c | 2 -- src/or/connection_or.c | 17 +++++++---------- 2 files changed, 7 insertions(+), 12 deletions(-)

1 0

[tor/master] Set renegotiation callbacks immediately on tls inititation
by nickm＠torproject.org 30 Nov '11

30 Nov '11

commit e27a26d568a257cf350814a9abfa47d3b41ad9f3 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Nov 27 08:29:51 2011 -0500 Set renegotiation callbacks immediately on tls inititation This way, we can't miss a renegotiation attempt in a v2 handshake, or miss excess renegotiation attempts. Partial fix for bug 4587. --- src/common/tortls.c | 2 -- src/or/connection_or.c | 17 +++++++---------- 2 files changed, 7 insertions(+), 12 deletions(-) diff --git a/src/common/tortls.c b/src/common/tortls.c index e052c85..aeb090b 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -1563,7 +1563,6 @@ tor_tls_set_renegotiate_callbacks(tor_tls_t *tls, tls->excess_renegotiations_callback = cb2; tls->callback_arg = arg; tls->got_renegotiate = 0; - SSL_set_info_callback(tls->ssl, tor_tls_state_changed_callback); } /** If this version of openssl requires it, turn on renegotiation on @@ -1767,7 +1766,6 @@ tor_tls_finish_handshake(tor_tls_t *tls) { int r = TOR_TLS_DONE; if (tls->isServer) { - SSL_set_info_callback(tls->ssl, NULL); SSL_set_verify(tls->ssl, SSL_VERIFY_PEER, always_accept_verify_cb); /* There doesn't seem to be a clear OpenSSL API to clear mode flags. */ tls->ssl->mode &= ~SSL_MODE_NO_AUTO_CHAIN; diff --git a/src/or/connection_or.c b/src/or/connection_or.c index e868b7b..0f68feb 100644 --- a/src/or/connection_or.c +++ b/src/or/connection_or.c @@ -42,6 +42,7 @@ static int connection_or_check_valid_tls_handshake(or_connection_t *conn, char *digest_rcvd_out); static void connection_or_tls_renegotiated_cb(tor_tls_t *tls, void *_conn); +static void connection_or_close_connection_cb(void *_conn); #ifdef USE_BUFFEREVENTS static void connection_or_handle_event_cb(struct bufferevent *bufev, @@ -1096,12 +1097,16 @@ connection_tls_start_handshake(or_connection_t *conn, int receiving) conn->_base.state = OR_CONN_STATE_TLS_HANDSHAKING; tor_assert(!conn->tls); conn->tls = tor_tls_new(conn->_base.s, receiving); - tor_tls_set_logged_address(conn->tls, // XXX client and relay? - escaped_safe_str(conn->_base.address)); if (!conn->tls) { log_warn(LD_BUG,"tor_tls_new failed. Closing."); return -1; } + tor_tls_set_logged_address(conn->tls, // XXX client and relay? + escaped_safe_str(conn->_base.address)); + tor_tls_set_renegotiate_callbacks(conn->tls, + connection_or_tls_renegotiated_cb, + connection_or_close_connection_cb, + conn); #ifdef USE_BUFFEREVENTS if (connection_type_uses_bufferevent(TO_CONN(conn))) { const int filtering = get_options()->_UseFilteringSSLBufferevents; @@ -1213,10 +1218,6 @@ connection_tls_continue_handshake(or_connection_t *conn) /* v2/v3 handshake, but not a client. */ log_debug(LD_OR, "Done with initial SSL handshake (server-side). " "Expecting renegotiation or VERSIONS cell"); - tor_tls_set_renegotiate_callbacks(conn->tls, - connection_or_tls_renegotiated_cb, - connection_or_close_connection_cb, - conn); conn->_base.state = OR_CONN_STATE_TLS_SERVER_RENEGOTIATING; connection_stop_writing(TO_CONN(conn)); connection_start_reading(TO_CONN(conn)); @@ -1277,10 +1278,6 @@ connection_or_handle_event_cb(struct bufferevent *bufev, short event, } else if (tor_tls_get_num_server_handshakes(conn->tls) == 1) { /* v2 or v3 handshake, as a server. Only got one handshake, so * wait for the next one. */ - tor_tls_set_renegotiate_callbacks(conn->tls, - connection_or_tls_renegotiated_cb, - connection_or_close_connection_cb, - conn); conn->_base.state = OR_CONN_STATE_TLS_SERVER_RENEGOTIATING; /* return 0; */ return; /* ???? */

1 0

[tor/master] Correct manpage entry for DynamicDHGroups
by nickm＠torproject.org 29 Nov '11

29 Nov '11

commit e718397880e47f7b194c5c05112df37eb0e86371 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Nov 29 18:42:49 2011 -0500 Correct manpage entry for DynamicDHGroups --- doc/tor.1.txt | 8 ++++---- 1 files changed, 4 insertions(+), 4 deletions(-) diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 009ba41..53d614a 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -245,10 +245,10 @@ Other options can be specified either on the command-line (--option distinguishable from other users, because you won't believe the same authorities they do. -**DynamicPrimes** **0**|**1**:: - If this option is set to 1, use a dynamic Diffie-Hellman prime - modulus instead of using the modulus of Apache's mod_ssl. This - option might help circumvent censorship based on static +**DynamicDHGroups** **0**|**1**:: + If this option is set to 1, when running as a server, generate our + own Diffie-Hellman group instead of using the one from Apache's mod_ssl. + This option may help circumvent censorship based on static Diffie-Hellman parameters. (Default: 1). **AlternateDirAuthority** [__nickname__] [**flags**] __address__:__port__ __fingerprint__ +

1 0

[tor/master] Copy/Paste Jake's stuff.
by nickm＠torproject.org 29 Nov '11

29 Nov '11

commit edec9409e85ba4a8b5d0575b23046d83d7562b87 Author: George Kadianakis <desnacked(a)gmail.com> Date: Thu Nov 24 22:06:50 2011 +0100 Copy/Paste Jake's stuff. This commit copies parts of Jake's f3bb6846975193d9a6649c31f94bda47e4014070 commit verbatim to the current master. --- src/common/crypto.c | 60 ++++++++++++++++++++++++++++++++++++++++++++++++-- src/common/crypto.h | 4 +++ 2 files changed, 61 insertions(+), 3 deletions(-) diff --git a/src/common/crypto.c b/src/common/crypto.c index f2ef833..aeaabaf 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -1816,23 +1816,71 @@ static BIGNUM *dh_param_p_tls = NULL; /** Shared G parameter for our DH key exchanges. */ static BIGNUM *dh_param_g = NULL; +/** Generate and return a reasonable and safe DH parameter p. */ +static BIGNUM *generate_rakshasa_prime(void) +{ + BIGNUM *rakshasa_prime, *misc; + DH *dh_parameters; + int r; + int dh_codes; + int rakshasa_bits = RAKSHASA_BITS; + int generator = DH_GENERATOR; + + dh_parameters = DH_new(); + rakshasa_prime = BN_new(); + misc = BN_new(); + + /** XXX - do we want to cache the result in a file? Or perhaps load from a file? */ + /* This implements the prime number strategy outlined in prop 179 */ + tor_assert(rakshasa_prime); + log_notice(LD_OR, "Generating Rakshasa prime; this will take a while..."); + dh_parameters = DH_generate_parameters(rakshasa_bits, generator, NULL, NULL); // XXX Do we want a pretty call back? + tor_assert(dh_parameters); + log_notice(LD_OR, "Rakshasa prime generated!"); + log_notice(LD_OR, "Testing our Rakshasa prime; this will take a while..."); + r = DH_check(dh_parameters, &dh_codes); + tor_assert(r); + log_notice(LD_OR, "Rakshasa prime seems probabilistically reasonable!"); + misc = BN_copy(rakshasa_prime, dh_parameters->p); + tor_assert(misc); + DH_free(dh_parameters); + + return rakshasa_prime; +} + /** Initialize dh_param_p and dh_param_g if they are not already * set. */ static void init_dh_param(void) { - BIGNUM *p, *p2, *g; + BIGNUM *rakshasa_prime, *p, *p2, *g; int r; if (dh_param_p && dh_param_g && dh_param_p_tls) return; + rakshasa_prime = BN_new(); p = BN_new(); p2 = BN_new(); g = BN_new(); + tor_assert(rakshasa_prime); tor_assert(p); tor_assert(p2); tor_assert(g); + /* Set our generator for all DH parameters */ + r = BN_set_word(g, generator); + tor_assert(r); + + /* Are we generating a random DH parameter?*/ + log_notice(LD_OR, "Do we want to generate a Rakshasa prime?"); + rakshasa = get_rakshasa(); + log_notice(LD_OR, "We think: %i?", rakshasa); + + /* This implements the prime number strategy outlined in prop 179 */ + if (rakshasa == 1) { + rakshasa_prime = generate_rakshasa_prime(); + } + /* This is from rfc2409, section 6.2. It's a safe prime, and supposedly it equals: 2^1024 - 2^960 - 1 + 2^64 * { [2^894 pi] + 129093 }. @@ -1845,7 +1893,9 @@ init_dh_param(void) "49286651ECE65381FFFFFFFFFFFFFFFF"); tor_assert(r); /* This is the 1024-bit safe prime that Apache uses for its DH stuff; see - * modules/ssl/ssl_engine_dh.c */ + * modules/ssl/ssl_engine_dh.c; Apache also uses a generator of 2 with this + * prime. + */ r = BN_hex2bn(&p2, "D67DE440CBBBDC1936D693D34AFD0AD50C84D239A45F520BB88174CB98" "BCE951849F912E639C72FB13B4B4D7177E16D55AC179BA420B2A29FE324A" @@ -1857,7 +1907,11 @@ init_dh_param(void) r = BN_set_word(g, 2); tor_assert(r); dh_param_p = p; - dh_param_p_tls = p2; + if (rakshasa) { + dh_param_p_tls = rakshasa_prime; + } else { + dh_param_p_tls = p2; + } dh_param_g = g; } diff --git a/src/common/crypto.h b/src/common/crypto.h index 80c1029..2929a2e 100644 --- a/src/common/crypto.h +++ b/src/common/crypto.h @@ -29,6 +29,10 @@ #define PK_BYTES (1024/8) /** Length of our DH keys. */ #define DH_BYTES (1024/8) +/** Our DH 'g' parameter */ +#define DH_GENERATOR 2 +/** Length of our Rakshasa DH parameter prime 'p' */ +#define RAKSHASA_BITS 1024 /** Length of a sha1 message digest when encoded in base64 with trailing = * signs removed. */

1 0

[tor/master] Introduce the DynamicPrimes configuration option.
by nickm＠torproject.org 29 Nov '11

29 Nov '11

commit 659381e00dc09deb4fb342d9f45cfae0b65aa33f Author: George Kadianakis <desnacked(a)gmail.com> Date: Tue Nov 22 04:53:43 2011 +0100 Introduce the DynamicPrimes configuration option. --- src/common/crypto.c | 13 ++++++------- src/common/crypto.h | 3 ++- src/or/config.c | 1 + src/or/main.c | 3 ++- src/or/or.h | 2 ++ src/or/router.c | 3 ++- src/test/test.c | 2 +- src/tools/tor-checkkey.c | 2 +- src/tools/tor-gencert.c | 2 +- 9 files changed, 18 insertions(+), 13 deletions(-) diff --git a/src/common/crypto.c b/src/common/crypto.c index aeaabaf..790ea16 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -224,13 +224,15 @@ try_load_engine(const char *path, const char *engine) /** Initialize the crypto library. Return 0 on success, -1 on failure. */ int -crypto_global_init(int useAccel, const char *accelName, const char *accelDir) +crypto_global_init(int useAccel, const char *accelName, const char *accelDir, + int DynamicPrimes) { if (!_crypto_global_initialized) { ERR_load_crypto_strings(); OpenSSL_add_all_algorithms(); _crypto_global_initialized = 1; setup_openssl_threading(); + use_dynamic_primes = DynamicPrimes; if (useAccel > 0) { #ifdef DISABLE_ENGINES (void)accelName; @@ -1815,6 +1817,8 @@ static BIGNUM *dh_param_p = NULL; static BIGNUM *dh_param_p_tls = NULL; /** Shared G parameter for our DH key exchanges. */ static BIGNUM *dh_param_g = NULL; +/** True if we use dynamic primes. */ +static int use_dynamic_primes = 0; /** Generate and return a reasonable and safe DH parameter p. */ static BIGNUM *generate_rakshasa_prime(void) @@ -1871,13 +1875,8 @@ init_dh_param(void) r = BN_set_word(g, generator); tor_assert(r); - /* Are we generating a random DH parameter?*/ - log_notice(LD_OR, "Do we want to generate a Rakshasa prime?"); - rakshasa = get_rakshasa(); - log_notice(LD_OR, "We think: %i?", rakshasa); - /* This implements the prime number strategy outlined in prop 179 */ - if (rakshasa == 1) { + if (use_dynamic_primes) { rakshasa_prime = generate_rakshasa_prime(); } diff --git a/src/common/crypto.h b/src/common/crypto.h index 2929a2e..99c52b1 100644 --- a/src/common/crypto.h +++ b/src/common/crypto.h @@ -87,7 +87,8 @@ typedef struct crypto_dh_env_t crypto_dh_env_t; /* global state */ int crypto_global_init(int hardwareAccel, const char *accelName, - const char *accelPath); + const char *accelPath, + int DynamicPrimes); void crypto_thread_cleanup(void); int crypto_global_cleanup(void); diff --git a/src/or/config.c b/src/or/config.c index 06d7d5c..4766b24 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -247,6 +247,7 @@ static config_var_t _option_vars[] = { VAR("DirServer", LINELIST, DirServers, NULL), V(DisableAllSwap, BOOL, "0"), V(DisableIOCP, BOOL, "1"), + V(DynamicPrimes, BOOL, "1"), V(DNSPort, LINELIST, NULL), V(DNSListenAddress, LINELIST, NULL), V(DownloadExtraInfo, BOOL, "0"), diff --git a/src/or/main.c b/src/or/main.c index 7008d38..3c75e1c 100644 --- a/src/or/main.c +++ b/src/or/main.c @@ -2275,7 +2275,8 @@ tor_init(int argc, char *argv[]) if (crypto_global_init(get_options()->HardwareAccel, get_options()->AccelName, - get_options()->AccelDir)) { + get_options()->AccelDir, + get_options()->DynamicPrimes)) { log_err(LD_BUG, "Unable to initialize OpenSSL. Exiting."); return -1; } diff --git a/src/or/or.h b/src/or/or.h index 67ba62b..b2ea3bc 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -2873,6 +2873,8 @@ typedef struct { char *Address; /**< OR only: configured address for this onion router. */ char *PidFile; /**< Where to store PID of Tor process. */ + int DynamicPrimes; /**< Enable dynamic generation of primes for use in DH. */ + routerset_t *ExitNodes; /**< Structure containing nicknames, digests, * country codes and IP address patterns of ORs to * consider as exits. */ diff --git a/src/or/router.c b/src/or/router.c index b6b96a5..414d346 100644 --- a/src/or/router.c +++ b/src/or/router.c @@ -514,7 +514,8 @@ init_keys(void) * openssl to initialize itself. */ if (crypto_global_init(get_options()->HardwareAccel, get_options()->AccelName, - get_options()->AccelDir)) { + get_options()->AccelDir, + get_options()->DynamicPrimes)) { log_err(LD_BUG, "Unable to initialize OpenSSL. Exiting."); return -1; } diff --git a/src/test/test.c b/src/test/test.c index d4edf14..26a55d1 100644 --- a/src/test/test.c +++ b/src/test/test.c @@ -1903,7 +1903,7 @@ main(int c, const char **v) } options->command = CMD_RUN_UNITTESTS; - if (crypto_global_init(0, NULL, NULL)) { + if (crypto_global_init(0, NULL, NULL, 1)) { printf("Can't initialize crypto subsystem; exiting.\n"); return 1; } diff --git a/src/tools/tor-checkkey.c b/src/tools/tor-checkkey.c index 94c8cbd..55480b4 100644 --- a/src/tools/tor-checkkey.c +++ b/src/tools/tor-checkkey.c @@ -31,7 +31,7 @@ main(int c, char **v) return 1; } - if (crypto_global_init(0, NULL, NULL)) { + if (crypto_global_init(0, NULL, NULL, 0)) { fprintf(stderr, "Couldn't initialize crypto library.\n"); return 1; } diff --git a/src/tools/tor-gencert.c b/src/tools/tor-gencert.c index 974a58b..b9f16d9 100644 --- a/src/tools/tor-gencert.c +++ b/src/tools/tor-gencert.c @@ -508,7 +508,7 @@ main(int argc, char **argv) init_logging(); /* Don't bother using acceleration. */ - if (crypto_global_init(0, NULL, NULL)) { + if (crypto_global_init(0, NULL, NULL, 0)) { fprintf(stderr, "Couldn't initialize crypto library.\n"); return 1; }

1 0

[tor/master] Rename "Rakshasa" to "Dynamic Prime".
by nickm＠torproject.org 29 Nov '11

29 Nov '11

commit 375e55eaa2439e18f7a0c5a9f6bc6324cbca37a0 Author: George Kadianakis <desnacked(a)gmail.com> Date: Tue Nov 22 05:08:26 2011 +0100 Rename "Rakshasa" to "Dynamic Prime". --- src/common/crypto.c | 39 ++++++++++++++++++--------------------- src/common/crypto.h | 2 -- 2 files changed, 18 insertions(+), 23 deletions(-) diff --git a/src/common/crypto.c b/src/common/crypto.c index 790ea16..a07cc96 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -1821,35 +1821,32 @@ static BIGNUM *dh_param_g = NULL; static int use_dynamic_primes = 0; /** Generate and return a reasonable and safe DH parameter p. */ -static BIGNUM *generate_rakshasa_prime(void) +static BIGNUM * +crypto_generate_dynamic_prime(void) { - BIGNUM *rakshasa_prime, *misc; + BIGNUM *dynamic_prime, *misc; DH *dh_parameters; int r; int dh_codes; - int rakshasa_bits = RAKSHASA_BITS; - int generator = DH_GENERATOR; dh_parameters = DH_new(); - rakshasa_prime = BN_new(); + dynamic_prime = BN_new(); misc = BN_new(); - /** XXX - do we want to cache the result in a file? Or perhaps load from a file? */ - /* This implements the prime number strategy outlined in prop 179 */ - tor_assert(rakshasa_prime); - log_notice(LD_OR, "Generating Rakshasa prime; this will take a while..."); - dh_parameters = DH_generate_parameters(rakshasa_bits, generator, NULL, NULL); // XXX Do we want a pretty call back? + tor_assert(dynamic_prime); + log_notice(LD_OR, "Generating Dynamic prime; this will take a while..."); + dh_parameters = DH_generate_parameters(DH_BYTES*8, DH_GENERATOR, NULL, NULL); // XXX Do we want a pretty call back? tor_assert(dh_parameters); - log_notice(LD_OR, "Rakshasa prime generated!"); - log_notice(LD_OR, "Testing our Rakshasa prime; this will take a while..."); + log_notice(LD_OR, "Dynamic prime generated!"); + log_notice(LD_OR, "Testing our Dynamic prime; this will take a while..."); r = DH_check(dh_parameters, &dh_codes); tor_assert(r); - log_notice(LD_OR, "Rakshasa prime seems probabilistically reasonable!"); - misc = BN_copy(rakshasa_prime, dh_parameters->p); + log_notice(LD_OR, "Dynamic prime seems probabilistically reasonable!"); + misc = BN_copy(dynamic_prime, dh_parameters->p); tor_assert(misc); DH_free(dh_parameters); - return rakshasa_prime; + return dynamic_prime; } /** Initialize dh_param_p and dh_param_g if they are not already @@ -1857,16 +1854,16 @@ static BIGNUM *generate_rakshasa_prime(void) static void init_dh_param(void) { - BIGNUM *rakshasa_prime, *p, *p2, *g; + BIGNUM *dynamic_prime, *p, *p2, *g; int r; if (dh_param_p && dh_param_g && dh_param_p_tls) return; - rakshasa_prime = BN_new(); + dynamic_prime = BN_new(); p = BN_new(); p2 = BN_new(); g = BN_new(); - tor_assert(rakshasa_prime); + tor_assert(dynamic_prime); tor_assert(p); tor_assert(p2); tor_assert(g); @@ -1877,7 +1874,7 @@ init_dh_param(void) /* This implements the prime number strategy outlined in prop 179 */ if (use_dynamic_primes) { - rakshasa_prime = generate_rakshasa_prime(); + dynamic_prime = crypto_generate_dynamic_prime(); } /* This is from rfc2409, section 6.2. It's a safe prime, and @@ -1906,8 +1903,8 @@ init_dh_param(void) r = BN_set_word(g, 2); tor_assert(r); dh_param_p = p; - if (rakshasa) { - dh_param_p_tls = rakshasa_prime; + if (use_dynamic_primes) { + dh_param_p_tls = dynamic_prime; } else { dh_param_p_tls = p2; } diff --git a/src/common/crypto.h b/src/common/crypto.h index 99c52b1..9e52bc4 100644 --- a/src/common/crypto.h +++ b/src/common/crypto.h @@ -31,8 +31,6 @@ #define DH_BYTES (1024/8) /** Our DH 'g' parameter */ #define DH_GENERATOR 2 -/** Length of our Rakshasa DH parameter prime 'p' */ -#define RAKSHASA_BITS 1024 /** Length of a sha1 message digest when encoded in base64 with trailing = * signs removed. */

1 0

[tor/master] Make it compile.
by nickm＠torproject.org 29 Nov '11

29 Nov '11

commit 1797e0a39e85f81e773304d7121e1f5f36fe9de9 Author: George Kadianakis <desnacked(a)gmail.com> Date: Tue Nov 22 05:13:34 2011 +0100 Make it compile. --- src/common/crypto.c | 7 ++++--- 1 files changed, 4 insertions(+), 3 deletions(-) diff --git a/src/common/crypto.c b/src/common/crypto.c index a07cc96..647d634 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -105,6 +105,9 @@ static tor_mutex_t **_openssl_mutexes = NULL; static int _n_openssl_mutexes = 0; #endif +/** True if we use dynamic primes. */ +static int use_dynamic_primes = 0; + /** A public key, or a public/private key-pair. */ struct crypto_pk_env_t { @@ -1817,8 +1820,6 @@ static BIGNUM *dh_param_p = NULL; static BIGNUM *dh_param_p_tls = NULL; /** Shared G parameter for our DH key exchanges. */ static BIGNUM *dh_param_g = NULL; -/** True if we use dynamic primes. */ -static int use_dynamic_primes = 0; /** Generate and return a reasonable and safe DH parameter p. */ static BIGNUM * @@ -1869,7 +1870,7 @@ init_dh_param(void) tor_assert(g); /* Set our generator for all DH parameters */ - r = BN_set_word(g, generator); + r = BN_set_word(g, DH_GENERATOR); tor_assert(r); /* This implements the prime number strategy outlined in prop 179 */

1 0