- tor-commits - lists.torproject.org

[tor/release-0.2.2] prepare a release blurb
by arma＠torproject.org 14 Sep '11

14 Sep '11

commit 8522652d8e9213d4adf6d1d712c233ad8c9190f7 Author: Roger Dingledine <arma(a)torproject.org> Date: Tue Sep 13 19:08:47 2011 -0400 prepare a release blurb --- ChangeLog | 26 +++++++++++++---------- ReleaseNotes | 63 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 78 insertions(+), 11 deletions(-) diff --git a/ChangeLog b/ChangeLog index d82ba49..e1a0c87 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,4 +1,8 @@ -Changes in version 0.2.2.33 - 2011-09-?? +Changes in version 0.2.2.33 - 2011-09-13 + Tor 0.2.2.33 fixes several bugs, and includes a slight tweak to Tor's + TLS handshake that makes relays and bridges that run this new version + reachable from Iran again. + o Major bugfixes: - Avoid an assertion failure when reloading a configuration with TrackExitHosts changes. Found and fixed by 'laruldan'. Fixes bug @@ -11,23 +15,23 @@ Changes in version 0.2.2.33 - 2011-09-?? by an attacker who controls both an introduction point and a rendezvous point, and who uses the malleability of AES-CTR to alter the encrypted g^x portion of the INTRODUCE1 cell. We think - that these attacks is infeasible (requiring the attacker to send + that these attacks are infeasible (requiring the attacker to send on the order of zettabytes of altered cells in a short interval), but we'd rather block them off in case there are any classes of this attack that we missed. Reported by Willem Pinckaers. o Minor features: - - Add a VoteOnHidServDirectoriesV2 configuration option to allow - directory authorities to abstain from voting on assignment of - the HSDir consensus flag. Related to bug 2649. - - Update to the September 6 2011 Maxmind GeoLite Country database. - - Change the default required uptime for a relay to be accepted as - a HSDir from 24 hours to 25 hours. Improves on 0.2.0.10-alpha; - resolves ticket 2649. - Adjust the expiration time on our SSL session certificates to better match SSL certs seen in the wild. Resolves ticket 4014. + - Change the default required uptime for a relay to be accepted as + a HSDir (hidden service directory) from 24 hours to 25 hours. + Improves on 0.2.0.10-alpha; resolves ticket 2649. + - Add a VoteOnHidServDirectoriesV2 config option to allow directory + authorities to abstain from voting on assignment of the HSDir + consensus flag. Related to bug 2649. + - Update to the September 6 2011 Maxmind GeoLite Country database. - o Minor bugfixes: + o Minor bugfixes (documentation and log messages): - Correct the man page to explain that HashedControlPassword and CookieAuthentication can both be set, in which case either method is sufficient to authenticate to Tor. Bugfix on 0.2.0.7-alpha, @@ -54,7 +58,7 @@ Changes in version 0.2.2.33 - 2011-09-?? - Clean up some code issues that prevented Tor from building on older BSDs. Fixes bug 3894; reported by "grarpamp". - Search for a platform-specific version of "ar" when cross-compiling. - Should fix builds on iOS. Found by Marco Bonetti. + Should fix builds on iOS. Resolves bug 3909, found by Marco Bonetti. Changes in version 0.2.2.32 - 2011-08-27 diff --git a/ReleaseNotes b/ReleaseNotes index da83fd2..a04bfae 100644 --- a/ReleaseNotes +++ b/ReleaseNotes @@ -3,6 +3,69 @@ This document summarizes new features and bugfixes in each stable release of Tor. If you want to see more detailed descriptions of the changes in each development snapshot, see the ChangeLog file. +Changes in version 0.2.2.33 - 2011-09-13 + Tor 0.2.2.33 fixes several bugs, and includes a slight tweak to Tor's + TLS handshake that makes relays and bridges that run this new version + reachable from Iran again. + + o Major bugfixes: + - Avoid an assertion failure when reloading a configuration with + TrackExitHosts changes. Found and fixed by 'laruldan'. Fixes bug + 3923; bugfix on 0.2.2.25-alpha. + + o Minor features (security): + - Check for replays of the public-key encrypted portion of an + INTRODUCE1 cell, in addition to the current check for replays of + the g^x value. This prevents a possible class of active attacks + by an attacker who controls both an introduction point and a + rendezvous point, and who uses the malleability of AES-CTR to + alter the encrypted g^x portion of the INTRODUCE1 cell. We think + that these attacks are infeasible (requiring the attacker to send + on the order of zettabytes of altered cells in a short interval), + but we'd rather block them off in case there are any classes of + this attack that we missed. Reported by Willem Pinckaers. + + o Minor features: + - Adjust the expiration time on our SSL session certificates to + better match SSL certs seen in the wild. Resolves ticket 4014. + - Change the default required uptime for a relay to be accepted as + a HSDir (hidden service directory) from 24 hours to 25 hours. + Improves on 0.2.0.10-alpha; resolves ticket 2649. + - Add a VoteOnHidServDirectoriesV2 config option to allow directory + authorities to abstain from voting on assignment of the HSDir + consensus flag. Related to bug 2649. + - Update to the September 6 2011 Maxmind GeoLite Country database. + + o Minor bugfixes (documentation and log messages): + - Correct the man page to explain that HashedControlPassword and + CookieAuthentication can both be set, in which case either method + is sufficient to authenticate to Tor. Bugfix on 0.2.0.7-alpha, + when we decided to allow these config options to both be set. Issue + raised by bug 3898. + - Demote the 'replay detected' log message emitted when a hidden + service receives the same Diffie-Hellman public key in two different + INTRODUCE2 cells to info level. A normal Tor client can cause that + log message during its normal operation. Bugfix on 0.2.1.6-alpha; + fixes part of bug 2442. + - Demote the 'INTRODUCE2 cell is too {old,new}' log message to info + level. There is nothing that a hidden service's operator can do + to fix its clients' clocks. Bugfix on 0.2.1.6-alpha; fixes part + of bug 2442. + - Clarify a log message specifying the characters permitted in + HiddenServiceAuthorizeClient client names. Previously, the log + message said that "[A-Za-z0-9+-_]" were permitted; that could have + given the impression that every ASCII character between "+" and "_" + was permitted. Now we say "[A-Za-z0-9+_-]". Bugfix on 0.2.1.5-alpha. + + o Build fixes: + - Provide a substitute implementation of lround() for MSVC, which + apparently lacks it. Patch from Gisle Vanem. + - Clean up some code issues that prevented Tor from building on older + BSDs. Fixes bug 3894; reported by "grarpamp". + - Search for a platform-specific version of "ar" when cross-compiling. + Should fix builds on iOS. Resolves bug 3909, found by Marco Bonetti. + + Changes in version 0.2.2.32 - 2011-08-27 The Tor 0.2.2 release series is dedicated to the memory of Andreas Pfitzmann (1958-2010), a pioneer in anonymity and privacy research,

1 0

[tor/release-0.2.2] bump to 0.2.2.33
by arma＠torproject.org 14 Sep '11

14 Sep '11

commit d9ec547452a016ee07fd3048c66ada9f3de269a3 Author: Roger Dingledine <arma(a)torproject.org> Date: Tue Sep 13 18:42:16 2011 -0400 bump to 0.2.2.33 --- configure.in | 2 +- contrib/tor-mingw.nsi.in | 2 +- src/win32/orconfig.h | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/configure.in b/configure.in index 09e3179..837688b 100644 --- a/configure.in +++ b/configure.in @@ -4,7 +4,7 @@ dnl Copyright (c) 2007-2008, The Tor Project, Inc. dnl See LICENSE for licensing information AC_INIT -AM_INIT_AUTOMAKE(tor, 0.2.2.32) +AM_INIT_AUTOMAKE(tor, 0.2.2.33) AM_CONFIG_HEADER(orconfig.h) AC_CANONICAL_HOST diff --git a/contrib/tor-mingw.nsi.in b/contrib/tor-mingw.nsi.in index 063dd92..4a5a484 100644 --- a/contrib/tor-mingw.nsi.in +++ b/contrib/tor-mingw.nsi.in @@ -8,7 +8,7 @@ !include "LogicLib.nsh" !include "FileFunc.nsh" !insertmacro GetParameters -!define VERSION "0.2.2.32" +!define VERSION "0.2.2.33" !define INSTALLER "tor-${VERSION}-win32.exe" !define WEBSITE "https://www.torproject.org/" !define LICENSE "LICENSE" diff --git a/src/win32/orconfig.h b/src/win32/orconfig.h index 5b0867f..323e0f1 100644 --- a/src/win32/orconfig.h +++ b/src/win32/orconfig.h @@ -233,5 +233,5 @@ #define USING_TWOS_COMPLEMENT /* Version number of package */ -#define VERSION "0.2.2.32" +#define VERSION "0.2.2.33"

1 0

[tor/release-0.2.2] fold in one more
by arma＠torproject.org 14 Sep '11

14 Sep '11

commit 8a6a95abb468b1a8d68683ac6995c1cb6e5e9a70 Author: Roger Dingledine <arma(a)torproject.org> Date: Tue Sep 13 18:34:50 2011 -0400 fold in one more --- ChangeLog | 2 ++ changes/bug4014 | 3 --- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index ba1d375..d82ba49 100644 --- a/ChangeLog +++ b/ChangeLog @@ -24,6 +24,8 @@ Changes in version 0.2.2.33 - 2011-09-?? - Change the default required uptime for a relay to be accepted as a HSDir from 24 hours to 25 hours. Improves on 0.2.0.10-alpha; resolves ticket 2649. + - Adjust the expiration time on our SSL session certificates to + better match SSL certs seen in the wild. Resolves ticket 4014. o Minor bugfixes: - Correct the man page to explain that HashedControlPassword and diff --git a/changes/bug4014 b/changes/bug4014 deleted file mode 100644 index 9c20c6c..0000000 --- a/changes/bug4014 +++ /dev/null @@ -1,3 +0,0 @@ - o Minor features: - - Adjust the expiration time on our SSL session certificates to - better match SSL certs seen in the wild. Resolves ticket 4014.

1 0

[tor/release-0.2.2] Generate our ssl session certs with a plausible lifetime
by arma＠torproject.org 14 Sep '11

14 Sep '11

commit 62ec584a3014b9b9333dcc6feb4989d1592d6d26 Author: Roger Dingledine <arma(a)torproject.org> Date: Tue Sep 13 18:24:45 2011 -0400 Generate our ssl session certs with a plausible lifetime Nobody but Tor uses certs on the wire with 2 hour lifetimes, and it makes us stand out. Resolves ticket 4014. --- changes/bug4014 | 3 +++ src/or/main.c | 8 +++++--- src/or/or.h | 4 +++- src/or/router.c | 6 ++++-- 4 files changed, 15 insertions(+), 6 deletions(-) diff --git a/changes/bug4014 b/changes/bug4014 new file mode 100644 index 0000000..9c20c6c --- /dev/null +++ b/changes/bug4014 @@ -0,0 +1,3 @@ + o Minor features: + - Adjust the expiration time on our SSL session certificates to + better match SSL certs seen in the wild. Resolves ticket 4014. diff --git a/src/or/main.c b/src/or/main.c index e44fd49..3c879dc 100644 --- a/src/or/main.c +++ b/src/or/main.c @@ -866,12 +866,14 @@ run_scheduled_events(time_t now) now + DESCRIPTOR_FAILURE_RESET_INTERVAL; } - /** 1b. Every MAX_SSL_KEY_LIFETIME seconds, we change our TLS context. */ + /** 1b. Every MAX_SSL_KEY_LIFETIME_INTERNAL seconds, we change our + * TLS context. */ if (!last_rotated_x509_certificate) last_rotated_x509_certificate = now; - if (last_rotated_x509_certificate+MAX_SSL_KEY_LIFETIME < now) { + if (last_rotated_x509_certificate+MAX_SSL_KEY_LIFETIME_INTERNAL < now) { log_info(LD_GENERAL,"Rotating tls context."); - if (tor_tls_context_new(get_identity_key(), MAX_SSL_KEY_LIFETIME) < 0) { + if (tor_tls_context_new(get_identity_key(), + MAX_SSL_KEY_LIFETIME_ADVERTISED) < 0) { log_warn(LD_BUG, "Error reinitializing TLS context"); /* XXX is it a bug here, that we just keep going? -RD */ } diff --git a/src/or/or.h b/src/or/or.h index 976ba9f..0f5b2bb 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -166,7 +166,9 @@ /** How often do we rotate onion keys? */ #define MIN_ONION_KEY_LIFETIME (7*24*60*60) /** How often do we rotate TLS contexts? */ -#define MAX_SSL_KEY_LIFETIME (2*60*60) +#define MAX_SSL_KEY_LIFETIME_INTERNAL (2*60*60) +/** What expiry time shall we place on our SSL certs? */ +#define MAX_SSL_KEY_LIFETIME_ADVERTISED (365*24*60*60) /** How old do we allow a router to get before removing it * from the router list? In seconds. */ diff --git a/src/or/router.c b/src/or/router.c index cc60041..2afde74 100644 --- a/src/or/router.c +++ b/src/or/router.c @@ -458,7 +458,8 @@ init_keys(void) } set_identity_key(prkey); /* Create a TLS context; default the client nickname to "client". */ - if (tor_tls_context_new(get_identity_key(), MAX_SSL_KEY_LIFETIME) < 0) { + if (tor_tls_context_new(get_identity_key(), + MAX_SSL_KEY_LIFETIME_ADVERTISED) < 0) { log_err(LD_GENERAL,"Error creating TLS context for Tor client."); return -1; } @@ -536,7 +537,8 @@ init_keys(void) tor_free(keydir); /* 3. Initialize link key and TLS context. */ - if (tor_tls_context_new(get_identity_key(), MAX_SSL_KEY_LIFETIME) < 0) { + if (tor_tls_context_new(get_identity_key(), + MAX_SSL_KEY_LIFETIME_ADVERTISED) < 0) { log_err(LD_GENERAL,"Error initializing TLS context"); return -1; }

1 0

[tor/release-0.2.2] Merge branch 'maint-0.2.1' into maint-0.2.2
by arma＠torproject.org 14 Sep '11

14 Sep '11

commit 4a351b4b9ebfadf27d68e6bb3e1470cdef83ef45 Merge: d679ef6 62ec584 Author: Roger Dingledine <arma(a)torproject.org> Date: Tue Sep 13 18:27:13 2011 -0400 Merge branch 'maint-0.2.1' into maint-0.2.2 Conflicts: src/or/main.c src/or/router.c changes/bug4014 | 3 +++ src/or/main.c | 7 ++++--- src/or/or.h | 4 +++- src/or/router.c | 4 ++-- 4 files changed, 12 insertions(+), 6 deletions(-) diff --cc src/or/main.c index bc639db,3c879dc..289d805 --- a/src/or/main.c +++ b/src/or/main.c @@@ -937,18 -866,14 +937,19 @@@ run_scheduled_events(time_t now now + DESCRIPTOR_FAILURE_RESET_INTERVAL; } + if (options->UseBridges) + fetch_bridge_descriptors(options, now); + - /** 1b. Every MAX_SSL_KEY_LIFETIME seconds, we change our TLS context. */ + /** 1b. Every MAX_SSL_KEY_LIFETIME_INTERNAL seconds, we change our + * TLS context. */ if (!last_rotated_x509_certificate) last_rotated_x509_certificate = now; - if (last_rotated_x509_certificate+MAX_SSL_KEY_LIFETIME < now) { + if (last_rotated_x509_certificate+MAX_SSL_KEY_LIFETIME_INTERNAL < now) { log_info(LD_GENERAL,"Rotating tls context."); - if (tor_tls_context_new(get_identity_key(), - MAX_SSL_KEY_LIFETIME_ADVERTISED) < 0) { + if (tor_tls_context_init(public_server_mode(options), + get_tlsclient_identity_key(), + is_server ? get_server_identity_key() : NULL, - MAX_SSL_KEY_LIFETIME) < 0) { ++ MAX_SSL_KEY_LIFETIME_ADVERTISED) < 0) { log_warn(LD_BUG, "Error reinitializing TLS context"); /* XXX is it a bug here, that we just keep going? -RD */ } diff --cc src/or/router.c index 2165e6e,2afde74..365e888 --- a/src/or/router.c +++ b/src/or/router.c @@@ -521,12 -456,10 +521,12 @@@ init_keys(void crypto_free_pk_env(prkey); return -1; } - set_identity_key(prkey); - /* Create a TLS context; default the client nickname to "client". */ - if (tor_tls_context_new(get_identity_key(), - MAX_SSL_KEY_LIFETIME_ADVERTISED) < 0) { + set_client_identity_key(prkey); + /* Create a TLS context. */ + if (tor_tls_context_init(0, + get_tlsclient_identity_key(), + NULL, - MAX_SSL_KEY_LIFETIME) < 0) { ++ MAX_SSL_KEY_LIFETIME_ADVERTISED) < 0) { log_err(LD_GENERAL,"Error creating TLS context for Tor client."); return -1; } @@@ -619,10 -537,8 +619,10 @@@ tor_free(keydir); /* 3. Initialize link key and TLS context. */ - if (tor_tls_context_new(get_identity_key(), - MAX_SSL_KEY_LIFETIME_ADVERTISED) < 0) { + if (tor_tls_context_init(public_server_mode(options), + get_tlsclient_identity_key(), + get_server_identity_key(), - MAX_SSL_KEY_LIFETIME) < 0) { ++ MAX_SSL_KEY_LIFETIME_ADVERTISED) < 0) { log_err(LD_GENERAL,"Error initializing TLS context"); return -1; }

1 0

[tor/release-0.2.2] Merge branch 'maint-0.2.2' into release-0.2.2
by arma＠torproject.org 14 Sep '11

14 Sep '11

commit a4ed8622c01fc1f2f93a44d4b3e0857b6da94620 Merge: 9d1ea45 4a351b4 Author: Roger Dingledine <arma(a)torproject.org> Date: Tue Sep 13 18:34:12 2011 -0400 Merge branch 'maint-0.2.2' into release-0.2.2 changes/bug4014 | 3 +++ src/or/main.c | 7 ++++--- src/or/or.h | 4 +++- src/or/router.c | 4 ++-- 4 files changed, 12 insertions(+), 6 deletions(-)

1 0

[tor/master] Generate our ssl session certs with a plausible lifetime
by arma＠torproject.org 14 Sep '11

14 Sep '11

commit 62ec584a3014b9b9333dcc6feb4989d1592d6d26 Author: Roger Dingledine <arma(a)torproject.org> Date: Tue Sep 13 18:24:45 2011 -0400 Generate our ssl session certs with a plausible lifetime Nobody but Tor uses certs on the wire with 2 hour lifetimes, and it makes us stand out. Resolves ticket 4014. --- changes/bug4014 | 3 +++ src/or/main.c | 8 +++++--- src/or/or.h | 4 +++- src/or/router.c | 6 ++++-- 4 files changed, 15 insertions(+), 6 deletions(-) diff --git a/changes/bug4014 b/changes/bug4014 new file mode 100644 index 0000000..9c20c6c --- /dev/null +++ b/changes/bug4014 @@ -0,0 +1,3 @@ + o Minor features: + - Adjust the expiration time on our SSL session certificates to + better match SSL certs seen in the wild. Resolves ticket 4014. diff --git a/src/or/main.c b/src/or/main.c index e44fd49..3c879dc 100644 --- a/src/or/main.c +++ b/src/or/main.c @@ -866,12 +866,14 @@ run_scheduled_events(time_t now) now + DESCRIPTOR_FAILURE_RESET_INTERVAL; } - /** 1b. Every MAX_SSL_KEY_LIFETIME seconds, we change our TLS context. */ + /** 1b. Every MAX_SSL_KEY_LIFETIME_INTERNAL seconds, we change our + * TLS context. */ if (!last_rotated_x509_certificate) last_rotated_x509_certificate = now; - if (last_rotated_x509_certificate+MAX_SSL_KEY_LIFETIME < now) { + if (last_rotated_x509_certificate+MAX_SSL_KEY_LIFETIME_INTERNAL < now) { log_info(LD_GENERAL,"Rotating tls context."); - if (tor_tls_context_new(get_identity_key(), MAX_SSL_KEY_LIFETIME) < 0) { + if (tor_tls_context_new(get_identity_key(), + MAX_SSL_KEY_LIFETIME_ADVERTISED) < 0) { log_warn(LD_BUG, "Error reinitializing TLS context"); /* XXX is it a bug here, that we just keep going? -RD */ } diff --git a/src/or/or.h b/src/or/or.h index 976ba9f..0f5b2bb 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -166,7 +166,9 @@ /** How often do we rotate onion keys? */ #define MIN_ONION_KEY_LIFETIME (7*24*60*60) /** How often do we rotate TLS contexts? */ -#define MAX_SSL_KEY_LIFETIME (2*60*60) +#define MAX_SSL_KEY_LIFETIME_INTERNAL (2*60*60) +/** What expiry time shall we place on our SSL certs? */ +#define MAX_SSL_KEY_LIFETIME_ADVERTISED (365*24*60*60) /** How old do we allow a router to get before removing it * from the router list? In seconds. */ diff --git a/src/or/router.c b/src/or/router.c index cc60041..2afde74 100644 --- a/src/or/router.c +++ b/src/or/router.c @@ -458,7 +458,8 @@ init_keys(void) } set_identity_key(prkey); /* Create a TLS context; default the client nickname to "client". */ - if (tor_tls_context_new(get_identity_key(), MAX_SSL_KEY_LIFETIME) < 0) { + if (tor_tls_context_new(get_identity_key(), + MAX_SSL_KEY_LIFETIME_ADVERTISED) < 0) { log_err(LD_GENERAL,"Error creating TLS context for Tor client."); return -1; } @@ -536,7 +537,8 @@ init_keys(void) tor_free(keydir); /* 3. Initialize link key and TLS context. */ - if (tor_tls_context_new(get_identity_key(), MAX_SSL_KEY_LIFETIME) < 0) { + if (tor_tls_context_new(get_identity_key(), + MAX_SSL_KEY_LIFETIME_ADVERTISED) < 0) { log_err(LD_GENERAL,"Error initializing TLS context"); return -1; }

1 0

[tor/master] Merge branch 'maint-0.2.1' into maint-0.2.2
by arma＠torproject.org 14 Sep '11

14 Sep '11

commit 4a351b4b9ebfadf27d68e6bb3e1470cdef83ef45 Merge: d679ef6 62ec584 Author: Roger Dingledine <arma(a)torproject.org> Date: Tue Sep 13 18:27:13 2011 -0400 Merge branch 'maint-0.2.1' into maint-0.2.2 Conflicts: src/or/main.c src/or/router.c changes/bug4014 | 3 +++ src/or/main.c | 7 ++++--- src/or/or.h | 4 +++- src/or/router.c | 4 ++-- 4 files changed, 12 insertions(+), 6 deletions(-) diff --cc src/or/main.c index bc639db,3c879dc..289d805 --- a/src/or/main.c +++ b/src/or/main.c @@@ -937,18 -866,14 +937,19 @@@ run_scheduled_events(time_t now now + DESCRIPTOR_FAILURE_RESET_INTERVAL; } + if (options->UseBridges) + fetch_bridge_descriptors(options, now); + - /** 1b. Every MAX_SSL_KEY_LIFETIME seconds, we change our TLS context. */ + /** 1b. Every MAX_SSL_KEY_LIFETIME_INTERNAL seconds, we change our + * TLS context. */ if (!last_rotated_x509_certificate) last_rotated_x509_certificate = now; - if (last_rotated_x509_certificate+MAX_SSL_KEY_LIFETIME < now) { + if (last_rotated_x509_certificate+MAX_SSL_KEY_LIFETIME_INTERNAL < now) { log_info(LD_GENERAL,"Rotating tls context."); - if (tor_tls_context_new(get_identity_key(), - MAX_SSL_KEY_LIFETIME_ADVERTISED) < 0) { + if (tor_tls_context_init(public_server_mode(options), + get_tlsclient_identity_key(), + is_server ? get_server_identity_key() : NULL, - MAX_SSL_KEY_LIFETIME) < 0) { ++ MAX_SSL_KEY_LIFETIME_ADVERTISED) < 0) { log_warn(LD_BUG, "Error reinitializing TLS context"); /* XXX is it a bug here, that we just keep going? -RD */ } diff --cc src/or/router.c index 2165e6e,2afde74..365e888 --- a/src/or/router.c +++ b/src/or/router.c @@@ -521,12 -456,10 +521,12 @@@ init_keys(void crypto_free_pk_env(prkey); return -1; } - set_identity_key(prkey); - /* Create a TLS context; default the client nickname to "client". */ - if (tor_tls_context_new(get_identity_key(), - MAX_SSL_KEY_LIFETIME_ADVERTISED) < 0) { + set_client_identity_key(prkey); + /* Create a TLS context. */ + if (tor_tls_context_init(0, + get_tlsclient_identity_key(), + NULL, - MAX_SSL_KEY_LIFETIME) < 0) { ++ MAX_SSL_KEY_LIFETIME_ADVERTISED) < 0) { log_err(LD_GENERAL,"Error creating TLS context for Tor client."); return -1; } @@@ -619,10 -537,8 +619,10 @@@ tor_free(keydir); /* 3. Initialize link key and TLS context. */ - if (tor_tls_context_new(get_identity_key(), - MAX_SSL_KEY_LIFETIME_ADVERTISED) < 0) { + if (tor_tls_context_init(public_server_mode(options), + get_tlsclient_identity_key(), + get_server_identity_key(), - MAX_SSL_KEY_LIFETIME) < 0) { ++ MAX_SSL_KEY_LIFETIME_ADVERTISED) < 0) { log_err(LD_GENERAL,"Error initializing TLS context"); return -1; }

1 0

[tor/master] Merge branch 'maint-0.2.2'
by arma＠torproject.org 14 Sep '11

14 Sep '11

commit 1fcaeb60924d155e80a9579588a1b6c31e2174f7 Merge: 1e1cc43 4a351b4 Author: Roger Dingledine <arma(a)torproject.org> Date: Tue Sep 13 18:32:00 2011 -0400 Merge branch 'maint-0.2.2' changes/bug4014 | 3 +++ src/or/main.c | 7 ++++--- src/or/or.h | 4 +++- src/or/router.c | 4 ++-- 4 files changed, 12 insertions(+), 6 deletions(-)

1 0

[tor/maint-0.2.2] Merge branch 'maint-0.2.1' into maint-0.2.2
by arma＠torproject.org 14 Sep '11

14 Sep '11

commit 4a351b4b9ebfadf27d68e6bb3e1470cdef83ef45 Merge: d679ef6 62ec584 Author: Roger Dingledine <arma(a)torproject.org> Date: Tue Sep 13 18:27:13 2011 -0400 Merge branch 'maint-0.2.1' into maint-0.2.2 Conflicts: src/or/main.c src/or/router.c changes/bug4014 | 3 +++ src/or/main.c | 7 ++++--- src/or/or.h | 4 +++- src/or/router.c | 4 ++-- 4 files changed, 12 insertions(+), 6 deletions(-) diff --cc src/or/main.c index bc639db,3c879dc..289d805 --- a/src/or/main.c +++ b/src/or/main.c @@@ -937,18 -866,14 +937,19 @@@ run_scheduled_events(time_t now now + DESCRIPTOR_FAILURE_RESET_INTERVAL; } + if (options->UseBridges) + fetch_bridge_descriptors(options, now); + - /** 1b. Every MAX_SSL_KEY_LIFETIME seconds, we change our TLS context. */ + /** 1b. Every MAX_SSL_KEY_LIFETIME_INTERNAL seconds, we change our + * TLS context. */ if (!last_rotated_x509_certificate) last_rotated_x509_certificate = now; - if (last_rotated_x509_certificate+MAX_SSL_KEY_LIFETIME < now) { + if (last_rotated_x509_certificate+MAX_SSL_KEY_LIFETIME_INTERNAL < now) { log_info(LD_GENERAL,"Rotating tls context."); - if (tor_tls_context_new(get_identity_key(), - MAX_SSL_KEY_LIFETIME_ADVERTISED) < 0) { + if (tor_tls_context_init(public_server_mode(options), + get_tlsclient_identity_key(), + is_server ? get_server_identity_key() : NULL, - MAX_SSL_KEY_LIFETIME) < 0) { ++ MAX_SSL_KEY_LIFETIME_ADVERTISED) < 0) { log_warn(LD_BUG, "Error reinitializing TLS context"); /* XXX is it a bug here, that we just keep going? -RD */ } diff --cc src/or/router.c index 2165e6e,2afde74..365e888 --- a/src/or/router.c +++ b/src/or/router.c @@@ -521,12 -456,10 +521,12 @@@ init_keys(void crypto_free_pk_env(prkey); return -1; } - set_identity_key(prkey); - /* Create a TLS context; default the client nickname to "client". */ - if (tor_tls_context_new(get_identity_key(), - MAX_SSL_KEY_LIFETIME_ADVERTISED) < 0) { + set_client_identity_key(prkey); + /* Create a TLS context. */ + if (tor_tls_context_init(0, + get_tlsclient_identity_key(), + NULL, - MAX_SSL_KEY_LIFETIME) < 0) { ++ MAX_SSL_KEY_LIFETIME_ADVERTISED) < 0) { log_err(LD_GENERAL,"Error creating TLS context for Tor client."); return -1; } @@@ -619,10 -537,8 +619,10 @@@ tor_free(keydir); /* 3. Initialize link key and TLS context. */ - if (tor_tls_context_new(get_identity_key(), - MAX_SSL_KEY_LIFETIME_ADVERTISED) < 0) { + if (tor_tls_context_init(public_server_mode(options), + get_tlsclient_identity_key(), + get_server_identity_key(), - MAX_SSL_KEY_LIFETIME) < 0) { ++ MAX_SSL_KEY_LIFETIME_ADVERTISED) < 0) { log_err(LD_GENERAL,"Error initializing TLS context"); return -1; }

1 0