- tor-commits - lists.torproject.org

[tor/maint-0.2.2] Reject create cells on outgoing OR connections from bridges
by arma＠torproject.org 27 Oct '11

27 Oct '11

commit a74e7fd40f1a77eb4000d8216bb5b80cdd8a6193 Author: Robert Ransom <rransom.8774(a)gmail.com> Date: Sun Oct 23 15:21:49 2011 -0700 Reject create cells on outgoing OR connections from bridges --- changes/issue-2011-10-23G | 9 +++++++++ src/or/command.c | 7 +++++-- 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/changes/issue-2011-10-23G b/changes/issue-2011-10-23G new file mode 100644 index 0000000..45f8675 --- /dev/null +++ b/changes/issue-2011-10-23G @@ -0,0 +1,9 @@ + o Security fixes: + + - Reject CREATE and CREATE_FAST cells on outgoing OR connections + from a bridge to a relay. Previously, we would accept them and + handle them normally, thereby allowing a malicious relay to + easily distinguish bridges which connect to it from clients. + Fixes CVE-2011-2769. Bugfix on 0.2.0.3-alpha, when bridges were + implemented; found by frosty_un. + diff --git a/src/or/command.c b/src/or/command.c index a17a3a6..54f23bb 100644 --- a/src/or/command.c +++ b/src/or/command.c @@ -219,6 +219,7 @@ static void command_process_create_cell(cell_t *cell, or_connection_t *conn) { or_circuit_t *circ; + or_options_t *options = get_options(); int id_is_high; if (we_are_hibernating()) { @@ -230,9 +231,11 @@ command_process_create_cell(cell_t *cell, or_connection_t *conn) return; } - if (!server_mode(get_options())) { + if (!server_mode(options) || + (!public_server_mode(options) && conn->is_outgoing)) { log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, - "Received create cell (type %d) from %s:%d, but we're a client. " + "Received create cell (type %d) from %s:%d, but we're connected " + "to it as a client. " "Sending back a destroy.", (int)cell->command, conn->_base.address, conn->_base.port); connection_or_send_destroy(cell->circ_id, conn,

1 0

[tor/maint-0.2.2] Make tor_version_same_series non-static
by arma＠torproject.org 27 Oct '11

27 Oct '11

commit 4d0f152aadabd431924acb137990081269cffb3d Author: Robert Ransom <rransom.8774(a)gmail.com> Date: Mon Oct 24 23:36:57 2011 -0700 Make tor_version_same_series non-static --- src/or/routerparse.c | 3 +-- src/or/routerparse.h | 1 + 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/or/routerparse.c b/src/or/routerparse.c index aed4fd1..001c4d6 100644 --- a/src/or/routerparse.c +++ b/src/or/routerparse.c @@ -572,7 +572,6 @@ static int check_signature_token(const char *digest, int flags, const char *doctype); static crypto_pk_env_t *find_dir_signing_key(const char *str, const char *eos); -static int tor_version_same_series(tor_version_t *a, tor_version_t *b); #undef DEBUG_AREA_ALLOC @@ -4556,7 +4555,7 @@ tor_version_compare(tor_version_t *a, tor_version_t *b) /** Return true iff versions <b>a</b> and <b>b</b> belong to the same series. */ -static int +int tor_version_same_series(tor_version_t *a, tor_version_t *b) { tor_assert(a); diff --git a/src/or/routerparse.h b/src/or/routerparse.h index 8b8cde2..527de5d 100644 --- a/src/or/routerparse.h +++ b/src/or/routerparse.h @@ -47,6 +47,7 @@ version_status_t tor_version_is_obsolete(const char *myversion, int tor_version_parse(const char *s, tor_version_t *out); int tor_version_as_new_as(const char *platform, const char *cutoff); int tor_version_compare(tor_version_t *a, tor_version_t *b); +int tor_version_same_series(tor_version_t *a, tor_version_t *b); void sort_version_list(smartlist_t *lst, int remove_duplicates); void assert_addr_policy_ok(smartlist_t *t); void dump_distinct_digest_count(int severity);

1 0

[tor/maint-0.2.2] Don't send a certificate chain on outgoing TLS connections from non-relays
by arma＠torproject.org 27 Oct '11

27 Oct '11

commit 638fdedcf16cf7d6f7c586d36f7ef335c1c9714f Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Oct 23 16:06:06 2011 +0000 Don't send a certificate chain on outgoing TLS connections from non-relays --- changes/issue-2011-10-19L | 12 ++++++ src/common/tortls.c | 93 ++++++++++++++++++++++++++------------------- 2 files changed, 66 insertions(+), 39 deletions(-) diff --git a/changes/issue-2011-10-19L b/changes/issue-2011-10-19L new file mode 100644 index 0000000..972823e --- /dev/null +++ b/changes/issue-2011-10-19L @@ -0,0 +1,12 @@ + o Security fixes: + + - Don't send TLS certificate chains on outgoing OR connections + from clients and bridges. Previously, each client or bridge + would use a single cert chain for all outgoing OR connections + for up to 24 hours, which allowed any relay connected to by a + client or bridge to determine which entry guards it is using. + This is a potential user-tracing bug for *all* users; everyone + who uses Tor's client or hidden service functionality should + upgrade. Fixes CVE-2011-2768. Bugfix on FIXME; found by + frosty_un. + diff --git a/src/common/tortls.c b/src/common/tortls.c index c78a9ec..cc805f8 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -186,9 +186,11 @@ static X509* tor_tls_create_certificate(crypto_pk_env_t *rsa, static void tor_tls_unblock_renegotiation(tor_tls_t *tls); static int tor_tls_context_init_one(tor_tls_context_t **ppcontext, crypto_pk_env_t *identity, - unsigned int key_lifetime); + unsigned int key_lifetime, + int is_client); static tor_tls_context_t *tor_tls_context_new(crypto_pk_env_t *identity, - unsigned int key_lifetime); + unsigned int key_lifetime, + int is_client); /** Global TLS contexts. We keep them here because nobody else needs * to touch them. */ @@ -624,7 +626,7 @@ tor_tls_context_init(int is_public_server, rv1 = tor_tls_context_init_one(&server_tls_context, server_identity, - key_lifetime); + key_lifetime, 0); if (rv1 >= 0) { new_ctx = server_tls_context; @@ -640,7 +642,8 @@ tor_tls_context_init(int is_public_server, if (server_identity != NULL) { rv1 = tor_tls_context_init_one(&server_tls_context, server_identity, - key_lifetime); + key_lifetime, + 0); } else { tor_tls_context_t *old_ctx = server_tls_context; server_tls_context = NULL; @@ -652,7 +655,8 @@ tor_tls_context_init(int is_public_server, rv2 = tor_tls_context_init_one(&client_tls_context, client_identity, - key_lifetime); + key_lifetime, + 1); } return rv1 < rv2 ? rv1 : rv2; @@ -669,10 +673,12 @@ tor_tls_context_init(int is_public_server, static int tor_tls_context_init_one(tor_tls_context_t **ppcontext, crypto_pk_env_t *identity, - unsigned int key_lifetime) + unsigned int key_lifetime, + int is_client) { tor_tls_context_t *new_ctx = tor_tls_context_new(identity, - key_lifetime); + key_lifetime, + is_client); tor_tls_context_t *old_ctx = *ppcontext; if (new_ctx != NULL) { @@ -694,7 +700,8 @@ tor_tls_context_init_one(tor_tls_context_t **ppcontext, * certificate. */ static tor_tls_context_t * -tor_tls_context_new(crypto_pk_env_t *identity, unsigned int key_lifetime) +tor_tls_context_new(crypto_pk_env_t *identity, unsigned int key_lifetime, + int is_client) { crypto_pk_env_t *rsa = NULL; EVP_PKEY *pkey = NULL; @@ -711,22 +718,26 @@ tor_tls_context_new(crypto_pk_env_t *identity, unsigned int key_lifetime) goto error; if (crypto_pk_generate_key(rsa)<0) goto error; - /* Create certificate signed by identity key. */ - cert = tor_tls_create_certificate(rsa, identity, nickname, nn2, - key_lifetime); - /* Create self-signed certificate for identity key. */ - idcert = tor_tls_create_certificate(identity, identity, nn2, nn2, - IDENTITY_CERT_LIFETIME); - if (!cert || !idcert) { - log(LOG_WARN, LD_CRYPTO, "Error creating certificate"); - goto error; + if (!is_client) { + /* Create certificate signed by identity key. */ + cert = tor_tls_create_certificate(rsa, identity, nickname, nn2, + key_lifetime); + /* Create self-signed certificate for identity key. */ + idcert = tor_tls_create_certificate(identity, identity, nn2, nn2, + IDENTITY_CERT_LIFETIME); + if (!cert || !idcert) { + log(LOG_WARN, LD_CRYPTO, "Error creating certificate"); + goto error; + } } result = tor_malloc_zero(sizeof(tor_tls_context_t)); result->refcnt = 1; - result->my_cert = X509_dup(cert); - result->my_id_cert = X509_dup(idcert); - result->key = crypto_pk_dup_key(rsa); + if (!is_client) { + result->my_cert = X509_dup(cert); + result->my_id_cert = X509_dup(idcert); + result->key = crypto_pk_dup_key(rsa); + } #ifdef EVERYONE_HAS_AES /* Tell OpenSSL to only use TLS1 */ @@ -758,27 +769,31 @@ tor_tls_context_new(crypto_pk_env_t *identity, unsigned int key_lifetime) #ifdef SSL_MODE_RELEASE_BUFFERS SSL_CTX_set_mode(result->ctx, SSL_MODE_RELEASE_BUFFERS); #endif - if (cert && !SSL_CTX_use_certificate(result->ctx,cert)) - goto error; - X509_free(cert); /* We just added a reference to cert. */ - cert=NULL; - if (idcert) { - X509_STORE *s = SSL_CTX_get_cert_store(result->ctx); - tor_assert(s); - X509_STORE_add_cert(s, idcert); - X509_free(idcert); /* The context now owns the reference to idcert */ - idcert = NULL; + if (! is_client) { + if (cert && !SSL_CTX_use_certificate(result->ctx,cert)) + goto error; + X509_free(cert); /* We just added a reference to cert. */ + cert=NULL; + if (idcert) { + X509_STORE *s = SSL_CTX_get_cert_store(result->ctx); + tor_assert(s); + X509_STORE_add_cert(s, idcert); + X509_free(idcert); /* The context now owns the reference to idcert */ + idcert = NULL; + } } SSL_CTX_set_session_cache_mode(result->ctx, SSL_SESS_CACHE_OFF); - tor_assert(rsa); - if (!(pkey = _crypto_pk_env_get_evp_pkey(rsa,1))) - goto error; - if (!SSL_CTX_use_PrivateKey(result->ctx, pkey)) - goto error; - EVP_PKEY_free(pkey); - pkey = NULL; - if (!SSL_CTX_check_private_key(result->ctx)) - goto error; + if (!is_client) { + tor_assert(rsa); + if (!(pkey = _crypto_pk_env_get_evp_pkey(rsa,1))) + goto error; + if (!SSL_CTX_use_PrivateKey(result->ctx, pkey)) + goto error; + EVP_PKEY_free(pkey); + pkey = NULL; + if (!SSL_CTX_check_private_key(result->ctx)) + goto error; + } { crypto_dh_env_t *dh = crypto_dh_new(DH_TYPE_TLS); SSL_CTX_set_tmp_dh(result->ctx, _crypto_dh_env_get_dh(dh));

1 0

[torbrowser/maint-2.2] bump all tbb versions to 2.2.34-1 and tor to 0.2.2.34
by erinn＠torproject.org 27 Oct '11

27 Oct '11

commit 78a0bcf0e521e638f0f190f5c4f56a8cb9afd549 Author: Erinn Clark <erinn(a)torproject.org> Date: Fri Oct 28 00:00:24 2011 +0100 bump all tbb versions to 2.2.34-1 and tor to 0.2.2.34 --- README.LINUX-2.2 | 8 ++++---- README.OSX-2.2 | 8 ++++---- README.WIN-2.2 | 6 +++--- build-scripts/linux.mk | 2 +- build-scripts/osx.mk | 2 +- build-scripts/versions.mk | 8 ++++---- build-scripts/windows.mk | 2 +- changelog.linux-2.2 | 8 ++++++++ changelog.osx-2.2 | 8 ++++++++ changelog.windows-2.2 | 8 ++++++++ 10 files changed, 42 insertions(+), 18 deletions(-) diff --git a/README.LINUX-2.2 b/README.LINUX-2.2 index c6de227..5149411 100644 --- a/README.LINUX-2.2 +++ b/README.LINUX-2.2 @@ -5,11 +5,11 @@ Included applications --------------------- Vidalia 0.2.15 (with Qt 4.6.2) -Tor 0.2.2.33 (with libevent-2.0.14-stable, zlib-1.2.5 and openssl-1.0.0e) +Tor 0.2.2.34 (with libevent-2.0.14-stable, zlib-1.2.5 and openssl-1.0.0e) Firefox (Aurora) 7.0.1 - \_ Torbutton 1.4.4 - |_ NoScript 2.1.4 - |_ HTTPS-Everywhere 1.0.3 + \_ Torbutton 1.4.4.1 + |_ NoScript 2.1.7 + |_ HTTPS-Everywhere 1.1 Usage ----- diff --git a/README.OSX-2.2 b/README.OSX-2.2 index 1fa2a62..1e56be0 100644 --- a/README.OSX-2.2 +++ b/README.OSX-2.2 @@ -5,11 +5,11 @@ Included applications --------------------- Vidalia 0.2.15 (with Qt 4.6.2) -Tor 0.2.2.33 (with libevent-2.0.14-stable, zlib-1.2.5 and openssl-1.0.0d) +Tor 0.2.2.34 (with libevent-2.0.14-stable, zlib-1.2.5 and openssl-1.0.0d) Firefox (Aurora) 7.0.1 - \_ Torbutton 1.4.4 - |_ NoScript 2.1.4 - |_ HTTPS-Everywhere 1.0.3 + \_ Torbutton 1.4.4.1 + |_ NoScript 2.1.7 + |_ HTTPS-Everywhere 1.1 Usage ----- diff --git a/README.WIN-2.2 b/README.WIN-2.2 index 0bc485b..67e73a1 100644 --- a/README.WIN-2.2 +++ b/README.WIN-2.2 @@ -5,12 +5,12 @@ Included applications --------------------- Vidalia 0.2.15 (with Qt 4.6.2) -Tor 0.2.2.33 (with libevent-2.0.14-stable, zlib-1.2.5 and openssl-1.0.0e) +Tor 0.2.2.34 (with libevent-2.0.14-stable, zlib-1.2.5 and openssl-1.0.0e) FirefoxPortable 7.0.1 \_ Firefox (Aurora) 7.0.1 \_ Torbutton 1.4.4.1 - |_ NoScript 2.1.4 - |_ HTTPS-Everywhere 1.0.3 + |_ NoScript 2.1.7 + |_ HTTPS-Everywhere 1.1 Usage ----- diff --git a/build-scripts/linux.mk b/build-scripts/linux.mk index 76949f5..73d0298 100644 --- a/build-scripts/linux.mk +++ b/build-scripts/linux.mk @@ -36,7 +36,7 @@ include $(PWD)/versions.mk ## Architecture ARCH_TYPE=$(shell uname -m) -BUILD_NUM=3 +BUILD_NUM=1 PLATFORM=Linux ## Location of directory for source unpacking diff --git a/build-scripts/osx.mk b/build-scripts/osx.mk index d131e85..a8a1841 100644 --- a/build-scripts/osx.mk +++ b/build-scripts/osx.mk @@ -36,7 +36,7 @@ include $(PWD)/versions.mk ## Architecture ARCH_TYPE=i386 -BUILD_NUM=3 +BUILD_NUM=1 PLATFORM=MacOS ## Location of directory for source unpacking diff --git a/build-scripts/versions.mk b/build-scripts/versions.mk index 9582dc0..ba20232 100644 --- a/build-scripts/versions.mk +++ b/build-scripts/versions.mk @@ -1,17 +1,17 @@ #!/usr/bin/make -RELEASE_VER=2.2.33 +RELEASE_VER=2.2.34 -HTTPSEVERY_VER=1.0.3 +HTTPSEVERY_VER=1.1 FIREFOX_VER=7.0.1 LIBEVENT_VER=2.0.14-stable LIBPNG_VER=1.4.8 -NOSCRIPT_VER=2.1.4 +NOSCRIPT_VER=2.1.7 OPENSSL_VER=1.0.0e OTR_VER=3.2.0 PIDGIN_VER=2.6.4 QT_VER=4.6.2 -TOR_VER=0.2.2.33 +TOR_VER=0.2.2.34 TORBUTTON_VER=1.4.4.1 VIDALIA_VER=0.2.15 ZLIB_VER=1.2.5 diff --git a/build-scripts/windows.mk b/build-scripts/windows.mk index f37a748..380596e 100644 --- a/build-scripts/windows.mk +++ b/build-scripts/windows.mk @@ -31,7 +31,7 @@ ## Include versions include $(PWD)/versions.mk -BUILD_NUM=3 +BUILD_NUM=1 PLATFORM=Windows ## Location of required libraries diff --git a/changelog.linux-2.2 b/changelog.linux-2.2 index a6add26..36df2d8 100644 --- a/changelog.linux-2.2 +++ b/changelog.linux-2.2 @@ -1,3 +1,11 @@ +Tor Browser Bundle (2.2.34-1); suite=linux + + * Update Tor to 0.2.2.34 + * Update NoScript 2.1.7 + * Update HTTPS Everywhere to 1.1 + + -- Erinn Clark <erinn(a)torproject.org> Thu Oct 27 02:33:56 BST 2011 + Tor Browser Bundle (2.2.33-3); suite=linux * Update Vidalia to 0.2.15 diff --git a/changelog.osx-2.2 b/changelog.osx-2.2 index e9b6daa..d4186fb 100644 --- a/changelog.osx-2.2 +++ b/changelog.osx-2.2 @@ -1,3 +1,11 @@ +Tor Browser Bundle (2.2.34-1); suite=osx + + * Update Tor to 0.2.2.34 + * Update NoScript 2.1.7 + * Update HTTPS Everywhere to 1.1 + + -- Erinn Clark <erinn(a)torproject.org> Thu Oct 27 02:24:06 BST 2011 + Tor Browser Bundle (2.2.33-3); suite=osx * Update Vidalia to 0.2.15 diff --git a/changelog.windows-2.2 b/changelog.windows-2.2 index d4a0bc8..5c20651 100644 --- a/changelog.windows-2.2 +++ b/changelog.windows-2.2 @@ -1,3 +1,11 @@ +Tor Browser Bundle (2.2.34-1); suite=windows + + * Update Tor to 0.2.2.34 + * Update NoScript 2.1.7 + * Update HTTPS Everywhere to 1.1 + + -- Erinn Clark <erinn(a)torproject.org> Thu Oct 27 02:33:41 BST 2011 + Tor Browser Bundle (2.2.33-3); suite=windows * Update Vidalia to 0.2.15

1 0

[torbrowser/maint-2.3] bump all tbb versions to 2.2.34-1 and tor to 0.2.2.34
by erinn＠torproject.org 27 Oct '11

27 Oct '11

commit 78a0bcf0e521e638f0f190f5c4f56a8cb9afd549 Author: Erinn Clark <erinn(a)torproject.org> Date: Fri Oct 28 00:00:24 2011 +0100 bump all tbb versions to 2.2.34-1 and tor to 0.2.2.34 --- README.LINUX-2.2 | 8 ++++---- README.OSX-2.2 | 8 ++++---- README.WIN-2.2 | 6 +++--- build-scripts/linux.mk | 2 +- build-scripts/osx.mk | 2 +- build-scripts/versions.mk | 8 ++++---- build-scripts/windows.mk | 2 +- changelog.linux-2.2 | 8 ++++++++ changelog.osx-2.2 | 8 ++++++++ changelog.windows-2.2 | 8 ++++++++ 10 files changed, 42 insertions(+), 18 deletions(-) diff --git a/README.LINUX-2.2 b/README.LINUX-2.2 index c6de227..5149411 100644 --- a/README.LINUX-2.2 +++ b/README.LINUX-2.2 @@ -5,11 +5,11 @@ Included applications --------------------- Vidalia 0.2.15 (with Qt 4.6.2) -Tor 0.2.2.33 (with libevent-2.0.14-stable, zlib-1.2.5 and openssl-1.0.0e) +Tor 0.2.2.34 (with libevent-2.0.14-stable, zlib-1.2.5 and openssl-1.0.0e) Firefox (Aurora) 7.0.1 - \_ Torbutton 1.4.4 - |_ NoScript 2.1.4 - |_ HTTPS-Everywhere 1.0.3 + \_ Torbutton 1.4.4.1 + |_ NoScript 2.1.7 + |_ HTTPS-Everywhere 1.1 Usage ----- diff --git a/README.OSX-2.2 b/README.OSX-2.2 index 1fa2a62..1e56be0 100644 --- a/README.OSX-2.2 +++ b/README.OSX-2.2 @@ -5,11 +5,11 @@ Included applications --------------------- Vidalia 0.2.15 (with Qt 4.6.2) -Tor 0.2.2.33 (with libevent-2.0.14-stable, zlib-1.2.5 and openssl-1.0.0d) +Tor 0.2.2.34 (with libevent-2.0.14-stable, zlib-1.2.5 and openssl-1.0.0d) Firefox (Aurora) 7.0.1 - \_ Torbutton 1.4.4 - |_ NoScript 2.1.4 - |_ HTTPS-Everywhere 1.0.3 + \_ Torbutton 1.4.4.1 + |_ NoScript 2.1.7 + |_ HTTPS-Everywhere 1.1 Usage ----- diff --git a/README.WIN-2.2 b/README.WIN-2.2 index 0bc485b..67e73a1 100644 --- a/README.WIN-2.2 +++ b/README.WIN-2.2 @@ -5,12 +5,12 @@ Included applications --------------------- Vidalia 0.2.15 (with Qt 4.6.2) -Tor 0.2.2.33 (with libevent-2.0.14-stable, zlib-1.2.5 and openssl-1.0.0e) +Tor 0.2.2.34 (with libevent-2.0.14-stable, zlib-1.2.5 and openssl-1.0.0e) FirefoxPortable 7.0.1 \_ Firefox (Aurora) 7.0.1 \_ Torbutton 1.4.4.1 - |_ NoScript 2.1.4 - |_ HTTPS-Everywhere 1.0.3 + |_ NoScript 2.1.7 + |_ HTTPS-Everywhere 1.1 Usage ----- diff --git a/build-scripts/linux.mk b/build-scripts/linux.mk index 76949f5..73d0298 100644 --- a/build-scripts/linux.mk +++ b/build-scripts/linux.mk @@ -36,7 +36,7 @@ include $(PWD)/versions.mk ## Architecture ARCH_TYPE=$(shell uname -m) -BUILD_NUM=3 +BUILD_NUM=1 PLATFORM=Linux ## Location of directory for source unpacking diff --git a/build-scripts/osx.mk b/build-scripts/osx.mk index d131e85..a8a1841 100644 --- a/build-scripts/osx.mk +++ b/build-scripts/osx.mk @@ -36,7 +36,7 @@ include $(PWD)/versions.mk ## Architecture ARCH_TYPE=i386 -BUILD_NUM=3 +BUILD_NUM=1 PLATFORM=MacOS ## Location of directory for source unpacking diff --git a/build-scripts/versions.mk b/build-scripts/versions.mk index 9582dc0..ba20232 100644 --- a/build-scripts/versions.mk +++ b/build-scripts/versions.mk @@ -1,17 +1,17 @@ #!/usr/bin/make -RELEASE_VER=2.2.33 +RELEASE_VER=2.2.34 -HTTPSEVERY_VER=1.0.3 +HTTPSEVERY_VER=1.1 FIREFOX_VER=7.0.1 LIBEVENT_VER=2.0.14-stable LIBPNG_VER=1.4.8 -NOSCRIPT_VER=2.1.4 +NOSCRIPT_VER=2.1.7 OPENSSL_VER=1.0.0e OTR_VER=3.2.0 PIDGIN_VER=2.6.4 QT_VER=4.6.2 -TOR_VER=0.2.2.33 +TOR_VER=0.2.2.34 TORBUTTON_VER=1.4.4.1 VIDALIA_VER=0.2.15 ZLIB_VER=1.2.5 diff --git a/build-scripts/windows.mk b/build-scripts/windows.mk index f37a748..380596e 100644 --- a/build-scripts/windows.mk +++ b/build-scripts/windows.mk @@ -31,7 +31,7 @@ ## Include versions include $(PWD)/versions.mk -BUILD_NUM=3 +BUILD_NUM=1 PLATFORM=Windows ## Location of required libraries diff --git a/changelog.linux-2.2 b/changelog.linux-2.2 index a6add26..36df2d8 100644 --- a/changelog.linux-2.2 +++ b/changelog.linux-2.2 @@ -1,3 +1,11 @@ +Tor Browser Bundle (2.2.34-1); suite=linux + + * Update Tor to 0.2.2.34 + * Update NoScript 2.1.7 + * Update HTTPS Everywhere to 1.1 + + -- Erinn Clark <erinn(a)torproject.org> Thu Oct 27 02:33:56 BST 2011 + Tor Browser Bundle (2.2.33-3); suite=linux * Update Vidalia to 0.2.15 diff --git a/changelog.osx-2.2 b/changelog.osx-2.2 index e9b6daa..d4186fb 100644 --- a/changelog.osx-2.2 +++ b/changelog.osx-2.2 @@ -1,3 +1,11 @@ +Tor Browser Bundle (2.2.34-1); suite=osx + + * Update Tor to 0.2.2.34 + * Update NoScript 2.1.7 + * Update HTTPS Everywhere to 1.1 + + -- Erinn Clark <erinn(a)torproject.org> Thu Oct 27 02:24:06 BST 2011 + Tor Browser Bundle (2.2.33-3); suite=osx * Update Vidalia to 0.2.15 diff --git a/changelog.windows-2.2 b/changelog.windows-2.2 index d4a0bc8..5c20651 100644 --- a/changelog.windows-2.2 +++ b/changelog.windows-2.2 @@ -1,3 +1,11 @@ +Tor Browser Bundle (2.2.34-1); suite=windows + + * Update Tor to 0.2.2.34 + * Update NoScript 2.1.7 + * Update HTTPS Everywhere to 1.1 + + -- Erinn Clark <erinn(a)torproject.org> Thu Oct 27 02:33:41 BST 2011 + Tor Browser Bundle (2.2.33-3); suite=windows * Update Vidalia to 0.2.15

1 0

[torbrowser/master] bump all tbb versions to 2.2.34-1 and tor to 0.2.2.34
by erinn＠torproject.org 27 Oct '11

27 Oct '11

commit 78a0bcf0e521e638f0f190f5c4f56a8cb9afd549 Author: Erinn Clark <erinn(a)torproject.org> Date: Fri Oct 28 00:00:24 2011 +0100 bump all tbb versions to 2.2.34-1 and tor to 0.2.2.34 --- README.LINUX-2.2 | 8 ++++---- README.OSX-2.2 | 8 ++++---- README.WIN-2.2 | 6 +++--- build-scripts/linux.mk | 2 +- build-scripts/osx.mk | 2 +- build-scripts/versions.mk | 8 ++++---- build-scripts/windows.mk | 2 +- changelog.linux-2.2 | 8 ++++++++ changelog.osx-2.2 | 8 ++++++++ changelog.windows-2.2 | 8 ++++++++ 10 files changed, 42 insertions(+), 18 deletions(-) diff --git a/README.LINUX-2.2 b/README.LINUX-2.2 index c6de227..5149411 100644 --- a/README.LINUX-2.2 +++ b/README.LINUX-2.2 @@ -5,11 +5,11 @@ Included applications --------------------- Vidalia 0.2.15 (with Qt 4.6.2) -Tor 0.2.2.33 (with libevent-2.0.14-stable, zlib-1.2.5 and openssl-1.0.0e) +Tor 0.2.2.34 (with libevent-2.0.14-stable, zlib-1.2.5 and openssl-1.0.0e) Firefox (Aurora) 7.0.1 - \_ Torbutton 1.4.4 - |_ NoScript 2.1.4 - |_ HTTPS-Everywhere 1.0.3 + \_ Torbutton 1.4.4.1 + |_ NoScript 2.1.7 + |_ HTTPS-Everywhere 1.1 Usage ----- diff --git a/README.OSX-2.2 b/README.OSX-2.2 index 1fa2a62..1e56be0 100644 --- a/README.OSX-2.2 +++ b/README.OSX-2.2 @@ -5,11 +5,11 @@ Included applications --------------------- Vidalia 0.2.15 (with Qt 4.6.2) -Tor 0.2.2.33 (with libevent-2.0.14-stable, zlib-1.2.5 and openssl-1.0.0d) +Tor 0.2.2.34 (with libevent-2.0.14-stable, zlib-1.2.5 and openssl-1.0.0d) Firefox (Aurora) 7.0.1 - \_ Torbutton 1.4.4 - |_ NoScript 2.1.4 - |_ HTTPS-Everywhere 1.0.3 + \_ Torbutton 1.4.4.1 + |_ NoScript 2.1.7 + |_ HTTPS-Everywhere 1.1 Usage ----- diff --git a/README.WIN-2.2 b/README.WIN-2.2 index 0bc485b..67e73a1 100644 --- a/README.WIN-2.2 +++ b/README.WIN-2.2 @@ -5,12 +5,12 @@ Included applications --------------------- Vidalia 0.2.15 (with Qt 4.6.2) -Tor 0.2.2.33 (with libevent-2.0.14-stable, zlib-1.2.5 and openssl-1.0.0e) +Tor 0.2.2.34 (with libevent-2.0.14-stable, zlib-1.2.5 and openssl-1.0.0e) FirefoxPortable 7.0.1 \_ Firefox (Aurora) 7.0.1 \_ Torbutton 1.4.4.1 - |_ NoScript 2.1.4 - |_ HTTPS-Everywhere 1.0.3 + |_ NoScript 2.1.7 + |_ HTTPS-Everywhere 1.1 Usage ----- diff --git a/build-scripts/linux.mk b/build-scripts/linux.mk index 76949f5..73d0298 100644 --- a/build-scripts/linux.mk +++ b/build-scripts/linux.mk @@ -36,7 +36,7 @@ include $(PWD)/versions.mk ## Architecture ARCH_TYPE=$(shell uname -m) -BUILD_NUM=3 +BUILD_NUM=1 PLATFORM=Linux ## Location of directory for source unpacking diff --git a/build-scripts/osx.mk b/build-scripts/osx.mk index d131e85..a8a1841 100644 --- a/build-scripts/osx.mk +++ b/build-scripts/osx.mk @@ -36,7 +36,7 @@ include $(PWD)/versions.mk ## Architecture ARCH_TYPE=i386 -BUILD_NUM=3 +BUILD_NUM=1 PLATFORM=MacOS ## Location of directory for source unpacking diff --git a/build-scripts/versions.mk b/build-scripts/versions.mk index 9582dc0..ba20232 100644 --- a/build-scripts/versions.mk +++ b/build-scripts/versions.mk @@ -1,17 +1,17 @@ #!/usr/bin/make -RELEASE_VER=2.2.33 +RELEASE_VER=2.2.34 -HTTPSEVERY_VER=1.0.3 +HTTPSEVERY_VER=1.1 FIREFOX_VER=7.0.1 LIBEVENT_VER=2.0.14-stable LIBPNG_VER=1.4.8 -NOSCRIPT_VER=2.1.4 +NOSCRIPT_VER=2.1.7 OPENSSL_VER=1.0.0e OTR_VER=3.2.0 PIDGIN_VER=2.6.4 QT_VER=4.6.2 -TOR_VER=0.2.2.33 +TOR_VER=0.2.2.34 TORBUTTON_VER=1.4.4.1 VIDALIA_VER=0.2.15 ZLIB_VER=1.2.5 diff --git a/build-scripts/windows.mk b/build-scripts/windows.mk index f37a748..380596e 100644 --- a/build-scripts/windows.mk +++ b/build-scripts/windows.mk @@ -31,7 +31,7 @@ ## Include versions include $(PWD)/versions.mk -BUILD_NUM=3 +BUILD_NUM=1 PLATFORM=Windows ## Location of required libraries diff --git a/changelog.linux-2.2 b/changelog.linux-2.2 index a6add26..36df2d8 100644 --- a/changelog.linux-2.2 +++ b/changelog.linux-2.2 @@ -1,3 +1,11 @@ +Tor Browser Bundle (2.2.34-1); suite=linux + + * Update Tor to 0.2.2.34 + * Update NoScript 2.1.7 + * Update HTTPS Everywhere to 1.1 + + -- Erinn Clark <erinn(a)torproject.org> Thu Oct 27 02:33:56 BST 2011 + Tor Browser Bundle (2.2.33-3); suite=linux * Update Vidalia to 0.2.15 diff --git a/changelog.osx-2.2 b/changelog.osx-2.2 index e9b6daa..d4186fb 100644 --- a/changelog.osx-2.2 +++ b/changelog.osx-2.2 @@ -1,3 +1,11 @@ +Tor Browser Bundle (2.2.34-1); suite=osx + + * Update Tor to 0.2.2.34 + * Update NoScript 2.1.7 + * Update HTTPS Everywhere to 1.1 + + -- Erinn Clark <erinn(a)torproject.org> Thu Oct 27 02:24:06 BST 2011 + Tor Browser Bundle (2.2.33-3); suite=osx * Update Vidalia to 0.2.15 diff --git a/changelog.windows-2.2 b/changelog.windows-2.2 index d4a0bc8..5c20651 100644 --- a/changelog.windows-2.2 +++ b/changelog.windows-2.2 @@ -1,3 +1,11 @@ +Tor Browser Bundle (2.2.34-1); suite=windows + + * Update Tor to 0.2.2.34 + * Update NoScript 2.1.7 + * Update HTTPS Everywhere to 1.1 + + -- Erinn Clark <erinn(a)torproject.org> Thu Oct 27 02:33:41 BST 2011 + Tor Browser Bundle (2.2.33-3); suite=windows * Update Vidalia to 0.2.15

1 0

[tor/release-0.2.1] slight tweak to text
by arma＠torproject.org 27 Oct '11

27 Oct '11

commit e740ac08c63f68c00f91aeffcd15bef74208fb69 Author: Roger Dingledine <arma(a)torproject.org> Date: Wed Oct 26 18:24:05 2011 -0400 slight tweak to text --- ChangeLog | 6 +++--- ReleaseNotes | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/ChangeLog b/ChangeLog index 98ee8a1..5c85e92 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,8 +1,8 @@ Changes in version 0.2.1.31 - 2011-10-26 Tor 0.2.1.31 backports important security and privacy fixes for oldstable. This release is intended only for package maintainers and - other users who cannot use the 0.2.2 stable series. All others should - be using Tor 0.2.2.x or newer. + others who cannot use the 0.2.2 stable series. All others should be + using Tor 0.2.2.x or newer. o Security fixes (also included in 0.2.2.x): - Replace all potentially sensitive memory comparison operations @@ -18,7 +18,7 @@ Changes in version 0.2.1.31 - 2011-10-26 o Privacy/anonymity fixes (also included in 0.2.2.x): - Clients and bridges no longer send TLS certificate chains on outgoing OR connections. Previously, each client or bridge - would use a single cert chain for all outgoing OR connections + would use the same cert chain for all outgoing OR connections for up to 24 hours, which allowed any relay that the client or bridge contacted to determine which entry guards it is using. Fixes CVE-2011-2768. Bugfix on 0.0.9pre5; found by frosty_un. diff --git a/ReleaseNotes b/ReleaseNotes index 7adef6f..b9d32eb 100644 --- a/ReleaseNotes +++ b/ReleaseNotes @@ -6,8 +6,8 @@ each development snapshot, see the ChangeLog file. Changes in version 0.2.1.31 - 2011-10-26 Tor 0.2.1.31 backports important security and privacy fixes for oldstable. This release is intended only for package maintainers and - other users who cannot use the 0.2.2 stable series. All others should - be using Tor 0.2.2.x or newer. + others who cannot use the 0.2.2 stable series. All others should be + using Tor 0.2.2.x or newer. o Security fixes (also included in 0.2.2.x): - Replace all potentially sensitive memory comparison operations @@ -23,7 +23,7 @@ Changes in version 0.2.1.31 - 2011-10-26 o Privacy/anonymity fixes (also included in 0.2.2.x): - Clients and bridges no longer send TLS certificate chains on outgoing OR connections. Previously, each client or bridge - would use a single cert chain for all outgoing OR connections + would use the same cert chain for all outgoing OR connections for up to 24 hours, which allowed any relay that the client or bridge contacted to determine which entry guards it is using. Fixes CVE-2011-2768. Bugfix on 0.0.9pre5; found by frosty_un.

1 0

[tor/release-0.2.1] Don't send a certificate chain on outgoing TLS connections from non-relays
by arma＠torproject.org 27 Oct '11

27 Oct '11

commit 638fdedcf16cf7d6f7c586d36f7ef335c1c9714f Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Oct 23 16:06:06 2011 +0000 Don't send a certificate chain on outgoing TLS connections from non-relays --- changes/issue-2011-10-19L | 12 ++++++ src/common/tortls.c | 93 ++++++++++++++++++++++++++------------------- 2 files changed, 66 insertions(+), 39 deletions(-) diff --git a/changes/issue-2011-10-19L b/changes/issue-2011-10-19L new file mode 100644 index 0000000..972823e --- /dev/null +++ b/changes/issue-2011-10-19L @@ -0,0 +1,12 @@ + o Security fixes: + + - Don't send TLS certificate chains on outgoing OR connections + from clients and bridges. Previously, each client or bridge + would use a single cert chain for all outgoing OR connections + for up to 24 hours, which allowed any relay connected to by a + client or bridge to determine which entry guards it is using. + This is a potential user-tracing bug for *all* users; everyone + who uses Tor's client or hidden service functionality should + upgrade. Fixes CVE-2011-2768. Bugfix on FIXME; found by + frosty_un. + diff --git a/src/common/tortls.c b/src/common/tortls.c index c78a9ec..cc805f8 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -186,9 +186,11 @@ static X509* tor_tls_create_certificate(crypto_pk_env_t *rsa, static void tor_tls_unblock_renegotiation(tor_tls_t *tls); static int tor_tls_context_init_one(tor_tls_context_t **ppcontext, crypto_pk_env_t *identity, - unsigned int key_lifetime); + unsigned int key_lifetime, + int is_client); static tor_tls_context_t *tor_tls_context_new(crypto_pk_env_t *identity, - unsigned int key_lifetime); + unsigned int key_lifetime, + int is_client); /** Global TLS contexts. We keep them here because nobody else needs * to touch them. */ @@ -624,7 +626,7 @@ tor_tls_context_init(int is_public_server, rv1 = tor_tls_context_init_one(&server_tls_context, server_identity, - key_lifetime); + key_lifetime, 0); if (rv1 >= 0) { new_ctx = server_tls_context; @@ -640,7 +642,8 @@ tor_tls_context_init(int is_public_server, if (server_identity != NULL) { rv1 = tor_tls_context_init_one(&server_tls_context, server_identity, - key_lifetime); + key_lifetime, + 0); } else { tor_tls_context_t *old_ctx = server_tls_context; server_tls_context = NULL; @@ -652,7 +655,8 @@ tor_tls_context_init(int is_public_server, rv2 = tor_tls_context_init_one(&client_tls_context, client_identity, - key_lifetime); + key_lifetime, + 1); } return rv1 < rv2 ? rv1 : rv2; @@ -669,10 +673,12 @@ tor_tls_context_init(int is_public_server, static int tor_tls_context_init_one(tor_tls_context_t **ppcontext, crypto_pk_env_t *identity, - unsigned int key_lifetime) + unsigned int key_lifetime, + int is_client) { tor_tls_context_t *new_ctx = tor_tls_context_new(identity, - key_lifetime); + key_lifetime, + is_client); tor_tls_context_t *old_ctx = *ppcontext; if (new_ctx != NULL) { @@ -694,7 +700,8 @@ tor_tls_context_init_one(tor_tls_context_t **ppcontext, * certificate. */ static tor_tls_context_t * -tor_tls_context_new(crypto_pk_env_t *identity, unsigned int key_lifetime) +tor_tls_context_new(crypto_pk_env_t *identity, unsigned int key_lifetime, + int is_client) { crypto_pk_env_t *rsa = NULL; EVP_PKEY *pkey = NULL; @@ -711,22 +718,26 @@ tor_tls_context_new(crypto_pk_env_t *identity, unsigned int key_lifetime) goto error; if (crypto_pk_generate_key(rsa)<0) goto error; - /* Create certificate signed by identity key. */ - cert = tor_tls_create_certificate(rsa, identity, nickname, nn2, - key_lifetime); - /* Create self-signed certificate for identity key. */ - idcert = tor_tls_create_certificate(identity, identity, nn2, nn2, - IDENTITY_CERT_LIFETIME); - if (!cert || !idcert) { - log(LOG_WARN, LD_CRYPTO, "Error creating certificate"); - goto error; + if (!is_client) { + /* Create certificate signed by identity key. */ + cert = tor_tls_create_certificate(rsa, identity, nickname, nn2, + key_lifetime); + /* Create self-signed certificate for identity key. */ + idcert = tor_tls_create_certificate(identity, identity, nn2, nn2, + IDENTITY_CERT_LIFETIME); + if (!cert || !idcert) { + log(LOG_WARN, LD_CRYPTO, "Error creating certificate"); + goto error; + } } result = tor_malloc_zero(sizeof(tor_tls_context_t)); result->refcnt = 1; - result->my_cert = X509_dup(cert); - result->my_id_cert = X509_dup(idcert); - result->key = crypto_pk_dup_key(rsa); + if (!is_client) { + result->my_cert = X509_dup(cert); + result->my_id_cert = X509_dup(idcert); + result->key = crypto_pk_dup_key(rsa); + } #ifdef EVERYONE_HAS_AES /* Tell OpenSSL to only use TLS1 */ @@ -758,27 +769,31 @@ tor_tls_context_new(crypto_pk_env_t *identity, unsigned int key_lifetime) #ifdef SSL_MODE_RELEASE_BUFFERS SSL_CTX_set_mode(result->ctx, SSL_MODE_RELEASE_BUFFERS); #endif - if (cert && !SSL_CTX_use_certificate(result->ctx,cert)) - goto error; - X509_free(cert); /* We just added a reference to cert. */ - cert=NULL; - if (idcert) { - X509_STORE *s = SSL_CTX_get_cert_store(result->ctx); - tor_assert(s); - X509_STORE_add_cert(s, idcert); - X509_free(idcert); /* The context now owns the reference to idcert */ - idcert = NULL; + if (! is_client) { + if (cert && !SSL_CTX_use_certificate(result->ctx,cert)) + goto error; + X509_free(cert); /* We just added a reference to cert. */ + cert=NULL; + if (idcert) { + X509_STORE *s = SSL_CTX_get_cert_store(result->ctx); + tor_assert(s); + X509_STORE_add_cert(s, idcert); + X509_free(idcert); /* The context now owns the reference to idcert */ + idcert = NULL; + } } SSL_CTX_set_session_cache_mode(result->ctx, SSL_SESS_CACHE_OFF); - tor_assert(rsa); - if (!(pkey = _crypto_pk_env_get_evp_pkey(rsa,1))) - goto error; - if (!SSL_CTX_use_PrivateKey(result->ctx, pkey)) - goto error; - EVP_PKEY_free(pkey); - pkey = NULL; - if (!SSL_CTX_check_private_key(result->ctx)) - goto error; + if (!is_client) { + tor_assert(rsa); + if (!(pkey = _crypto_pk_env_get_evp_pkey(rsa,1))) + goto error; + if (!SSL_CTX_use_PrivateKey(result->ctx, pkey)) + goto error; + EVP_PKEY_free(pkey); + pkey = NULL; + if (!SSL_CTX_check_private_key(result->ctx)) + goto error; + } { crypto_dh_env_t *dh = crypto_dh_new(DH_TYPE_TLS); SSL_CTX_set_tmp_dh(result->ctx, _crypto_dh_env_get_dh(dh));

1 0

[tor/release-0.2.1] Don't use any OR connection which sent us a CREATE_FAST cell for an EXTEND
by arma＠torproject.org 27 Oct '11

27 Oct '11

commit af12c39d6de5bbcd24915db3c4cc9404f102ac02 Author: Robert Ransom <rransom.8774(a)gmail.com> Date: Sun Oct 23 14:27:56 2011 -0700 Don't use any OR connection which sent us a CREATE_FAST cell for an EXTEND Fix suggested by Nick Mathewson. --- changes/issue-2011-10-19L | 9 +++++++++ src/or/command.c | 6 ++++++ src/or/connection_or.c | 5 +++++ src/or/or.h | 4 ++++ 4 files changed, 24 insertions(+), 0 deletions(-) diff --git a/changes/issue-2011-10-19L b/changes/issue-2011-10-19L index 972823e..1fefd72 100644 --- a/changes/issue-2011-10-19L +++ b/changes/issue-2011-10-19L @@ -10,3 +10,12 @@ upgrade. Fixes CVE-2011-2768. Bugfix on FIXME; found by frosty_un. + - Don't use any OR connection on which we have received a + CREATE_FAST cell to satisfy an EXTEND request. Previously, we + would not consider whether a connection appears to be from a + client or bridge when deciding whether to use that connection to + satisfy an EXTEND request. Mitigates CVE-2011-2768, by + preventing an attacker from determining whether an unpatched + client is connected to a patched relay. Bugfix on FIXME; found + by frosty_un. + diff --git a/src/or/command.c b/src/or/command.c index 61b898c..a17a3a6 100644 --- a/src/or/command.c +++ b/src/or/command.c @@ -285,7 +285,13 @@ command_process_create_cell(cell_t *cell, or_connection_t *conn) * a CPU worker. */ char keys[CPATH_KEY_MATERIAL_LEN]; char reply[DIGEST_LEN*2]; + tor_assert(cell->command == CELL_CREATE_FAST); + + /* Make sure we never try to use the OR connection on which we + * received this cell to satisfy an EXTEND request, */ + conn->is_connection_with_client = 1; + if (fast_server_handshake(cell->payload, (uint8_t*)reply, (uint8_t*)keys, sizeof(keys))<0) { log_warn(LD_OR,"Failed to generate key material. Closing."); diff --git a/src/or/connection_or.c b/src/or/connection_or.c index 95cc02e..35f6da9 100644 --- a/src/or/connection_or.c +++ b/src/or/connection_or.c @@ -519,6 +519,11 @@ connection_or_get_for_extend(const char *digest, tor_assert(tor_memeq(conn->identity_digest, digest, DIGEST_LEN)); if (conn->_base.marked_for_close) continue; + /* Never return a connection on which the other end appears to be + * a client. */ + if (conn->is_connection_with_client) { + continue; + } /* Never return a non-open connection. */ if (conn->_base.state != OR_CONN_STATE_OPEN) { /* If the address matches, don't launch a new connection for this diff --git a/src/or/or.h b/src/or/or.h index 4105ff4..72e4c63 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -1031,6 +1031,10 @@ typedef struct or_connection_t { * because the connection is too old, or because there's a better one, etc. */ unsigned int is_bad_for_new_circs:1; + /** True iff we have decided that the other end of this connection + * is a client. Connections with this flag set should never be used + * to satisfy an EXTEND request. */ + unsigned int is_connection_with_client:1; uint8_t link_proto; /**< What protocol version are we using? 0 for * "none negotiated yet." */ circid_t next_circ_id; /**< Which circ_id do we try to use next on

1 0

[tor/release-0.2.1] Mark which OR connections are outgoing
by arma＠torproject.org 27 Oct '11

27 Oct '11

commit c05bb53508f5fe3e570a285e6c9ead452ded0e43 Author: Robert Ransom <rransom.8774(a)gmail.com> Date: Sun Oct 23 14:58:00 2011 -0700 Mark which OR connections are outgoing --- src/or/connection_or.c | 2 ++ src/or/or.h | 2 ++ 2 files changed, 4 insertions(+), 0 deletions(-) diff --git a/src/or/connection_or.c b/src/or/connection_or.c index 35f6da9..f019c79 100644 --- a/src/or/connection_or.c +++ b/src/or/connection_or.c @@ -776,6 +776,8 @@ connection_or_connect(const tor_addr_t *_addr, uint16_t port, conn->_base.state = OR_CONN_STATE_CONNECTING; control_event_or_conn_status(conn, OR_CONN_EVENT_LAUNCHED, 0); + conn->is_outgoing = 1; + if (options->HttpsProxy) { /* we shouldn't connect directly. use the https proxy instead. */ tor_addr_from_ipv4h(&addr, options->HttpsProxyAddr); diff --git a/src/or/or.h b/src/or/or.h index 72e4c63..edbb73c 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -1035,6 +1035,8 @@ typedef struct or_connection_t { * is a client. Connections with this flag set should never be used * to satisfy an EXTEND request. */ unsigned int is_connection_with_client:1; + /** True iff this is an outgoing connection. */ + unsigned int is_outgoing:1; uint8_t link_proto; /**< What protocol version are we using? 0 for * "none negotiated yet." */ circid_t next_circ_id; /**< Which circ_id do we try to use next on

1 0