- tor-commits - lists.torproject.org

[arm/master] Adding procName util to readme and package
by atagar＠torproject.org 03 May '11

03 May '11

commit 908acf3170058fc4deacba1fc2f82549d2d54c02 Author: Damian Johnson <atagar(a)torproject.org> Date: Tue May 3 09:49:42 2011 -0700 Adding procName util to readme and package --- README | 1 + src/util/__init__.py | 2 +- 2 files changed, 2 insertions(+), 1 deletions(-) diff --git a/README b/README index 50657a1..ff03b37 100644 --- a/README +++ b/README @@ -172,6 +172,7 @@ Layout: log.py - aggregator for application events panel.py - wrapper for safely working with curses subwindows procTools.py - queries process & system information from /proc contents + procName.py - renames our process to a friendlier name sysTools.py - helper for system calls, providing client side caching torConfig.py - functions for working with the torrc and config options torTools.py - TorCtl wrapper, providing caching and derived information diff --git a/src/util/__init__.py b/src/util/__init__.py index dd65242..365e82a 100644 --- a/src/util/__init__.py +++ b/src/util/__init__.py @@ -4,5 +4,5 @@ application's status, making cross platform system calls, parsing tor data, and safely working with curses (hiding some of the gory details). """ -__all__ = ["conf", "connections", "enum", "hostnames", "log", "panel", "procTools", "sysTools", "torConfig", "torTools", "uiTools"] +__all__ = ["conf", "connections", "enum", "hostnames", "log", "panel", "procTools", "procName", "sysTools", "torConfig", "torTools", "uiTools"]

1 0

[arm/master] Renaming procname to procName
by atagar＠torproject.org 03 May '11

03 May '11

commit 6c07b110c6b9b0d2285a5875d98647abaf8d67b8 Author: Damian Johnson <atagar(a)torproject.org> Date: Tue May 3 09:47:52 2011 -0700 Renaming procname to procName The rest of the utils follow a camel-case convention so this one should too. --- src/starter.py | 4 +- src/util/procName.py | 115 ++++++++++++++++++++++++++++++++++++++++++++++++++ src/util/procname.py | 115 -------------------------------------------------- 3 files changed, 117 insertions(+), 117 deletions(-) diff --git a/src/starter.py b/src/starter.py index 5b73a73..be97d0e 100644 --- a/src/starter.py +++ b/src/starter.py @@ -391,8 +391,8 @@ if __name__ == '__main__': # "arm <input args>" try: - from util import procname - procname.renameProcess("arm\0%s" % "\0".join(sys.argv[1:])) + from util import procName + procName.renameProcess("arm\0%s" % "\0".join(sys.argv[1:])) except: pass cli.controller.startTorMonitor(time.time() - initTime, expandedEvents, param["startup.blindModeEnabled"]) diff --git a/src/util/procName.py b/src/util/procName.py new file mode 100644 index 0000000..97dc707 --- /dev/null +++ b/src/util/procName.py @@ -0,0 +1,115 @@ +# Module to allow for arbitrary renaming of our python process. This is mostly +# based on: +# http://www.rhinocerus.net/forum/lang-python/569677-setting-program-name-lik… +# and an adaptation by Jake: https://github.com/ioerror/chameleon +# +# A cleaner implementation is available at: +# https://github.com/cream/libs/blob/b38970e2a6f6d2620724c828808235be0445b799… +# but I'm not quite clear on their implementation, and it only does targeted +# argument replacement (ie, replace argv[0], argv[1], etc but with a string +# the same size). + +import sys +import ctypes +import ctypes.util + +# flag for setting the process name, found in '/usr/include/linux/prctl.h' +PR_SET_NAME = 15 + +argc_t = ctypes.POINTER(ctypes.c_char_p) + +Py_GetArgcArgv = ctypes.pythonapi.Py_GetArgcArgv +Py_GetArgcArgv.restype = None +Py_GetArgcArgv.argtypes = [ctypes.POINTER(ctypes.c_int), + ctypes.POINTER(argc_t)] + +# tracks the last name we've changed the process to +currentProcessName = None +maxNameLength = -1 + +def renameProcess(processName): + """ + Renames our current process from "python <args>" to a custom name. + + Arguments: + processName - new name for our process + """ + + _setArgv(processName) + if sys.platform == "linux2": + _setPrctlName(processName) + elif sys.platform == "freebsd7": + _setProcTitle(processName) + +def _setArgv(processName): + """ + Overwrites our argv in a similar fashion to how it's done in C with: + strcpy(argv[0], "new_name"); + """ + + global currentProcessName, maxNameLength + + argv = ctypes.c_int(0) + argc = argc_t() + Py_GetArgcArgv(argv, ctypes.pointer(argc)) + + # The original author did the memset for 256, while Jake did it for the + # processName length (capped at 1608). I'm not sure of the reasons for + # either of these limits, but setting it to anything higher than than the + # length of the null terminated process name should be pointless, so opting + # for Jake's implementation on this. + + if currentProcessName == None: + # Getting argv via... + # currentProcessName = " ".join(["python"] + sys.argv) + # + # doesn't do the trick since this will miss interpretor arguments like... + # python -W ignore::DeprecationWarning myScript.py + # + # Hence we're fetching this via our ctypes argv. Alternatively we could + # use ps, though this is less desirable: + # "ps -p %i -o args" % os.getpid() + + args = [] + for i in range(100): + if argc[i] == None: break + args.append(str(argc[i])) + + currentProcessName = " ".join(args) + maxNameLength = len(currentProcessName) + + if len(processName) > maxNameLength: + msg = "can't rename process to something longer than our initial name since this would overwrite memory used for the env" + raise IOError(msg) + + # space we need to clear + zeroSize = max(len(currentProcessName), len(processName)) + + ctypes.memset(argc.contents, 0, zeroSize + 1) # null terminate the string's end + ctypes.memmove(argc.contents, processName, len(processName)) + currentProcessName = processName + +def _setPrctlName(processName): + """ + Sets the prctl name, which is used by top and killall. This appears to be + Linux specific and has the max of 15 characters. Source: + http://stackoverflow.com/questions/564695/is-there-a-way-to-change-effectiv… + """ + + libc = ctypes.CDLL(ctypes.util.find_library("c")) + nameBuffer = ctypes.create_string_buffer(len(processName)+1) + nameBuffer.value = processName + libc.prctl(PR_SET_NAME, ctypes.byref(nameBuffer), 0, 0, 0) + +def _setProcTitle(processName): + """ + BSD specific calls (should be compataible with both FreeBSD and OpenBSD: + http://fxr.watson.org/fxr/source/gen/setproctitle.c?v=FREEBSD-LIBC + http://www.rootr.net/man/man/setproctitle/3 + """ + + libc = ctypes.CDLL(ctypes.util.find_library("c")) + nameBuffer = ctypes.create_string_buffer(len(processName)+1) + nameBuffer.value = processName + libc.setproctitle(ctypes.byref(nameBuffer)) + diff --git a/src/util/procname.py b/src/util/procname.py deleted file mode 100644 index 97dc707..0000000 --- a/src/util/procname.py +++ /dev/null @@ -1,115 +0,0 @@ -# Module to allow for arbitrary renaming of our python process. This is mostly -# based on: -# http://www.rhinocerus.net/forum/lang-python/569677-setting-program-name-lik… -# and an adaptation by Jake: https://github.com/ioerror/chameleon -# -# A cleaner implementation is available at: -# https://github.com/cream/libs/blob/b38970e2a6f6d2620724c828808235be0445b799… -# but I'm not quite clear on their implementation, and it only does targeted -# argument replacement (ie, replace argv[0], argv[1], etc but with a string -# the same size). - -import sys -import ctypes -import ctypes.util - -# flag for setting the process name, found in '/usr/include/linux/prctl.h' -PR_SET_NAME = 15 - -argc_t = ctypes.POINTER(ctypes.c_char_p) - -Py_GetArgcArgv = ctypes.pythonapi.Py_GetArgcArgv -Py_GetArgcArgv.restype = None -Py_GetArgcArgv.argtypes = [ctypes.POINTER(ctypes.c_int), - ctypes.POINTER(argc_t)] - -# tracks the last name we've changed the process to -currentProcessName = None -maxNameLength = -1 - -def renameProcess(processName): - """ - Renames our current process from "python <args>" to a custom name. - - Arguments: - processName - new name for our process - """ - - _setArgv(processName) - if sys.platform == "linux2": - _setPrctlName(processName) - elif sys.platform == "freebsd7": - _setProcTitle(processName) - -def _setArgv(processName): - """ - Overwrites our argv in a similar fashion to how it's done in C with: - strcpy(argv[0], "new_name"); - """ - - global currentProcessName, maxNameLength - - argv = ctypes.c_int(0) - argc = argc_t() - Py_GetArgcArgv(argv, ctypes.pointer(argc)) - - # The original author did the memset for 256, while Jake did it for the - # processName length (capped at 1608). I'm not sure of the reasons for - # either of these limits, but setting it to anything higher than than the - # length of the null terminated process name should be pointless, so opting - # for Jake's implementation on this. - - if currentProcessName == None: - # Getting argv via... - # currentProcessName = " ".join(["python"] + sys.argv) - # - # doesn't do the trick since this will miss interpretor arguments like... - # python -W ignore::DeprecationWarning myScript.py - # - # Hence we're fetching this via our ctypes argv. Alternatively we could - # use ps, though this is less desirable: - # "ps -p %i -o args" % os.getpid() - - args = [] - for i in range(100): - if argc[i] == None: break - args.append(str(argc[i])) - - currentProcessName = " ".join(args) - maxNameLength = len(currentProcessName) - - if len(processName) > maxNameLength: - msg = "can't rename process to something longer than our initial name since this would overwrite memory used for the env" - raise IOError(msg) - - # space we need to clear - zeroSize = max(len(currentProcessName), len(processName)) - - ctypes.memset(argc.contents, 0, zeroSize + 1) # null terminate the string's end - ctypes.memmove(argc.contents, processName, len(processName)) - currentProcessName = processName - -def _setPrctlName(processName): - """ - Sets the prctl name, which is used by top and killall. This appears to be - Linux specific and has the max of 15 characters. Source: - http://stackoverflow.com/questions/564695/is-there-a-way-to-change-effectiv… - """ - - libc = ctypes.CDLL(ctypes.util.find_library("c")) - nameBuffer = ctypes.create_string_buffer(len(processName)+1) - nameBuffer.value = processName - libc.prctl(PR_SET_NAME, ctypes.byref(nameBuffer), 0, 0, 0) - -def _setProcTitle(processName): - """ - BSD specific calls (should be compataible with both FreeBSD and OpenBSD: - http://fxr.watson.org/fxr/source/gen/setproctitle.c?v=FREEBSD-LIBC - http://www.rootr.net/man/man/setproctitle/3 - """ - - libc = ctypes.CDLL(ctypes.util.find_library("c")) - nameBuffer = ctypes.create_string_buffer(len(processName)+1) - nameBuffer.value = processName - libc.setproctitle(ctypes.byref(nameBuffer)) -

1 0

[vidalia/alpha] Port BridgeDownloader from QHttp to QtNetwork
by chiiph＠torproject.org 03 May '11

03 May '11

commit cbfe5e908026729818d91d2fbb17a92469574abd Author: Tomas Touceda <chiiph(a)gentoo.org> Date: Fri Apr 15 12:34:01 2011 -0300 Port BridgeDownloader from QHttp to QtNetwork QHttp is deprecated in the latest versions. Also, added a check for the certificate sha1 digest. --- src/vidalia/config/BridgeDownloader.cpp | 71 +++++++++----------- src/vidalia/config/BridgeDownloader.h | 17 ++--- .../config/BridgeDownloaderProgressDialog.cpp | 2 +- .../config/BridgeDownloaderProgressDialog.h | 2 +- src/vidalia/config/NetworkPage.cpp | 4 +- 5 files changed, 44 insertions(+), 52 deletions(-) diff --git a/src/vidalia/config/BridgeDownloader.cpp b/src/vidalia/config/BridgeDownloader.cpp index d70034d..15d73cb 100644 --- a/src/vidalia/config/BridgeDownloader.cpp +++ b/src/vidalia/config/BridgeDownloader.cpp @@ -16,34 +16,26 @@ #include "BridgeDownloader.h" #include "Vidalia.h" -#include <QSslSocket> - #define BRIDGEDB_HOST "bridges.torproject.org" #define BRIDGEDB_PORT 443 - +#define BRIDGEDB_SHA1 "a7e70f8a648fe04a9677f13eedf6f91b5f7f2e25" BridgeDownloader::BridgeDownloader(QObject *parent) - : QObject(parent), - _requestId(0) + : QObject(parent) { - _https = new QHttp(BRIDGEDB_HOST, QHttp::ConnectionModeHttps, - BRIDGEDB_PORT, this); - - connect(_https, SIGNAL(stateChanged(int)), - this, SLOT(httpsStateChanged(int))); - connect(_https, SIGNAL(requestFinished(int, bool)), - this, SLOT(httpsRequestFinished(int, bool))); - connect(_https, SIGNAL(dataReadProgress(int, int)), - this, SIGNAL(downloadProgress(int, int))); - connect(_https, SIGNAL(sslErrors(QList<QSslError>)), - this, SLOT(sslErrors(QList<QSslError>))); + _https = new QNetworkAccessManager(); + + connect(_https, SIGNAL(finished(QNetworkReply *)), + this, SLOT(httpsRequestFinished(QNetworkReply *))); + connect(_https, SIGNAL(sslErrors(QNetworkReply *, QList<QSslError>)), + this, SLOT(sslErrors(QNetworkReply *, QList<QSslError>))); } void BridgeDownloader::setProxy(const QString &host, int port, const QString &username, const QString &password) { - _https->setProxy(host, port, username, password); + _https->setProxy(QNetworkProxy(QNetworkProxy::HttpProxy, host, port, username, password)); } bool @@ -82,16 +74,18 @@ BridgeDownloader::startHttpsDownload() emit statusChanged(tr("Starting HTTPS bridge request...")); emit downloadProgress(0, 0); - _requestId = _https->get("/?format=plain"); - vInfo("Sending an HTTPS bridge request to %1:%2 (id %3).").arg(BRIDGEDB_HOST) - .arg(BRIDGEDB_PORT) - .arg(_requestId); + _reply = _https->get(QNetworkRequest(QUrl("https://bridges.torproject.org/?format=plain"))); + connect(_reply, SIGNAL(downloadProgress(qint64, qint64)), + this, SIGNAL(downloadProgress(qint64, qint64))); + vInfo("Sending an HTTPS bridge request to %1:%2.").arg(BRIDGEDB_HOST) + .arg(BRIDGEDB_PORT); } void BridgeDownloader::cancelBridgeRequest() { - _https->abort(); + _reply->close(); + disconnect(_reply, 0, 0, 0); } void @@ -117,20 +111,16 @@ BridgeDownloader::httpsStateChanged(int state) } void -BridgeDownloader::httpsRequestFinished(int id, bool error) +BridgeDownloader::httpsRequestFinished(QNetworkReply *reply) { - if (id != _requestId) - return; - - if (error) { - QString errorString = _https->errorString(); - vWarn("Bridge request failed (id %1): %2").arg(id).arg(errorString); + if (reply->error() != QNetworkReply::NoError) { + QString errorString = reply->errorString(); + vWarn("Bridge request failed: %2").arg(errorString); emit bridgeRequestFailed(errorString); } else { - QByteArray response = _https->readAll(); - vInfo("Bridge request complete (id %1): received %2 bytes.").arg(id) - .arg(response.size()); + QByteArray response = reply->readAll(); + vInfo("Bridge request complete: received %2 bytes.").arg(response.size()); QStringList bridges, lines = QString(response).split("\n"); foreach (QString line, lines) { @@ -140,22 +130,27 @@ BridgeDownloader::httpsRequestFinished(int id, bool error) } emit bridgeRequestFinished(bridges); } - _https->close(); + _reply->close(); + disconnect(_reply,0,0,0); } void -BridgeDownloader::sslErrors(const QList<QSslError> &sslErrors) +BridgeDownloader::sslErrors(QNetworkReply *reply, const QList<QSslError> &sslErrors) { QString errorString; QStringList errorStrings; - vWarn("%1 SSL error(s) when requesting bridge information (id %2):") - .arg(sslErrors.size()) - .arg(_requestId); + vWarn("%1 SSL error(s) when requesting bridge information:") + .arg(sslErrors.size()); foreach (QSslError sslError, sslErrors) { errorString = sslError.errorString(); errorStrings << errorString; vWarn(" SSL Error: %1").arg(errorString); } -} + // Check if the certificate is the one we expect + if(_reply->sslConfiguration().peerCertificate().digest(QCryptographicHash::Sha1)==QByteArray::fromHex(BRIDGEDB_SHA1)) { + _reply->ignoreSslErrors(); + } else + vWarn("There's been a problem with the certificate."); +} diff --git a/src/vidalia/config/BridgeDownloader.h b/src/vidalia/config/BridgeDownloader.h index 0cb87f4..cf30979 100644 --- a/src/vidalia/config/BridgeDownloader.h +++ b/src/vidalia/config/BridgeDownloader.h @@ -16,10 +16,7 @@ #ifndef _BRIDGEDOWNLOADER_H #define _BRIDGEDOWNLOADER_H -#include <QHttp> -#include <QSslError> -#include <QStringList> - +#include <QtNetwork> class BridgeDownloader : public QObject { @@ -65,7 +62,7 @@ signals: * have been read so far. Note that total may be 0 if the expected * total size of the response is not known. */ - void downloadProgress(int done, int total); + void downloadProgress(qint64 done, qint64 total); /** Emitted when the status of the bridge request changes. status * describes the new current state of the request. @@ -98,14 +95,14 @@ private slots: * signal is ignored since it is the result of a close() or abort() * request. */ - void httpsRequestFinished(int id, bool error); + void httpsRequestFinished(QNetworkReply *reply); /** Called when the HTTPS connection encounters one or more * sslErrors. Currently the errors are just logged and * bridgeRequestFailed() is not emitted, since QHttp will also * emit */ - void sslErrors(const QList<QSslError> &sslErrors); + void sslErrors(QNetworkReply *, const QList<QSslError> &sslErrors); private: /** Initiates an HTTPS connection to bridges.torproject.org to start @@ -115,10 +112,10 @@ private: /** Used to connect to the bridge database, send an HTTPS request for * new bridge addresses and then read the response. */ - QHttp* _https; + QNetworkAccessManager* _https; - /** Unique numeric identifier of the current bridge request. */ - int _requestId; + /** Identifier of the current bridge request */ + QNetworkReply *_reply; }; #endif diff --git a/src/vidalia/config/BridgeDownloaderProgressDialog.cpp b/src/vidalia/config/BridgeDownloaderProgressDialog.cpp index b4d8e28..f16daa8 100644 --- a/src/vidalia/config/BridgeDownloaderProgressDialog.cpp +++ b/src/vidalia/config/BridgeDownloaderProgressDialog.cpp @@ -46,7 +46,7 @@ BridgeDownloaderProgressDialog::setStatus(const QString &status) } void -BridgeDownloaderProgressDialog::setDownloadProgress(int done, int total) +BridgeDownloaderProgressDialog::setDownloadProgress(qint64 done, qint64 total) { ui.progressBar->setRange(0, total); ui.progressBar->setValue(done); diff --git a/src/vidalia/config/BridgeDownloaderProgressDialog.h b/src/vidalia/config/BridgeDownloaderProgressDialog.h index 86fb0d3..d9d505f 100644 --- a/src/vidalia/config/BridgeDownloaderProgressDialog.h +++ b/src/vidalia/config/BridgeDownloaderProgressDialog.h @@ -39,7 +39,7 @@ public slots: * maximum steps. If value and maximum are both 0, * then a "busy" progress bar is displayed. */ - void setDownloadProgress(int value, int maximum); + void setDownloadProgress(qint64 value, qint64 maximum); /** Called when the bridge download completes successfully and discards * the progress dialog with an Accept result code. bridges diff --git a/src/vidalia/config/NetworkPage.cpp b/src/vidalia/config/NetworkPage.cpp index f5bbc72..7154334 100644 --- a/src/vidalia/config/NetworkPage.cpp +++ b/src/vidalia/config/NetworkPage.cpp @@ -389,8 +389,8 @@ NetworkPage::findBridges() connect(_bridgeDownloader, SIGNAL(statusChanged(QString)), dlg, SLOT(setStatus(QString))); - connect(_bridgeDownloader, SIGNAL(downloadProgress(int, int)), - dlg, SLOT(setDownloadProgress(int, int))); + connect(_bridgeDownloader, SIGNAL(downloadProgress(qint64, qint64)), + dlg, SLOT(setDownloadProgress(qint64, qint64))); connect(_bridgeDownloader, SIGNAL(bridgeRequestFailed(QString)), dlg, SLOT(bridgeRequestFailed(QString))); connect(_bridgeDownloader, SIGNAL(bridgeRequestFinished(QStringList)),

1 0

[vidalia/alpha] Handle the validation by adding DigiCert's CAs
by chiiph＠torproject.org 03 May '11

03 May '11

commit 2470c0bda9923a67710fce2ed5fbcc03c3f018f2 Author: Tomas Touceda <chiiph(a)gentoo.org> Date: Thu Apr 28 13:20:46 2011 -0300 Handle the validation by adding DigiCert's CAs --- src/vidalia/Vidalia.cpp | 9 +++++++++ src/vidalia/config/BridgeDownloader.cpp | 7 ------- src/vidalia/res/DigiCertAssuredCA.crt | 22 ++++++++++++++++++++++ src/vidalia/res/DigiCertCA.crt | 22 ++++++++++++++++++++++ src/vidalia/res/DigiCertHighAssuranceCA.crt | 23 +++++++++++++++++++++++ src/vidalia/res/vidalia.qrc | 3 +++ 6 files changed, 79 insertions(+), 7 deletions(-) diff --git a/src/vidalia/Vidalia.cpp b/src/vidalia/Vidalia.cpp index f88c94f..5c22da3 100644 --- a/src/vidalia/Vidalia.cpp +++ b/src/vidalia/Vidalia.cpp @@ -509,5 +509,14 @@ Vidalia::loadDefaultCaCertificates() const if (! QSslSocket::addDefaultCaCertificates(":/pki/EquifaxSecureCA.crt")) vWarn("Failed to add the Equifax Secure CA certificate to the default CA " "certificate database."); + if (! QSslSocket::addDefaultCaCertificates(":/pki/DigiCertCA.crt")) + vWarn("Failed to add the DigiCert Global CA certificate to the default CA " + "certificate database."); + if (! QSslSocket::addDefaultCaCertificates(":/pki/DigiCertCA2.crt")) + vWarn("Failed to add the DigiCert Assured CA certificate to the default CA " + "certificate database."); + if (! QSslSocket::addDefaultCaCertificates(":/pki/DigiCertCA3.crt")) + vWarn("Failed to add the DigiCert High Assurance CA certificate to the default CA " + "certificate database."); } diff --git a/src/vidalia/config/BridgeDownloader.cpp b/src/vidalia/config/BridgeDownloader.cpp index 15d73cb..f1ac91a 100644 --- a/src/vidalia/config/BridgeDownloader.cpp +++ b/src/vidalia/config/BridgeDownloader.cpp @@ -18,7 +18,6 @@ #define BRIDGEDB_HOST "bridges.torproject.org" #define BRIDGEDB_PORT 443 -#define BRIDGEDB_SHA1 "a7e70f8a648fe04a9677f13eedf6f91b5f7f2e25" BridgeDownloader::BridgeDownloader(QObject *parent) : QObject(parent) @@ -147,10 +146,4 @@ BridgeDownloader::sslErrors(QNetworkReply *reply, const QList<QSslError> &sslErr errorStrings << errorString; vWarn(" SSL Error: %1").arg(errorString); } - - // Check if the certificate is the one we expect - if(_reply->sslConfiguration().peerCertificate().digest(QCryptographicHash::Sha1)==QByteArray::fromHex(BRIDGEDB_SHA1)) { - _reply->ignoreSslErrors(); - } else - vWarn("There's been a problem with the certificate."); } diff --git a/src/vidalia/res/DigiCertAssuredCA.crt b/src/vidalia/res/DigiCertAssuredCA.crt new file mode 100644 index 0000000..2731638 --- /dev/null +++ b/src/vidalia/res/DigiCertAssuredCA.crt @@ -0,0 +1,22 @@ +-----BEGIN CERTIFICATE----- +MIIDtzCCAp+gAwIBAgIQDOfg5RfYRv6P5WD8G/AwOTANBgkqhkiG9w0BAQUFADBl +MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 +d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJv +b3QgQ0EwHhcNMDYxMTEwMDAwMDAwWhcNMzExMTEwMDAwMDAwWjBlMQswCQYDVQQG +EwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNl +cnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJvb3QgQ0EwggEi +MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCtDhXO5EOAXLGH87dg+XESpa7c +JpSIqvTO9SA5KFhgDPiA2qkVlTJhPLWxKISKityfCgyDF3qPkKyK53lTXDGEKvYP +mDI2dsze3Tyoou9q+yHyUmHfnyDXH+Kx2f4YZNISW1/5WBg1vEfNoTb5a3/UsDg+ +wRvDjDPZ2C8Y/igPs6eD1sNuRMBhNZYW/lmci3Zt1/GiSw0r/wty2p5g0I6QNcZ4 +VYcgoc/lbQrISXwxmDNsIumH0DJaoroTghHtORedmTpyoeb6pNnVFzF1roV9Iq4/ +AUaG9ih5yLHa5FcXxH4cDrC0kqZWs72yl+2qp/C3xag/lRbQ/6GW6whfGHdPAgMB +AAGjYzBhMA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQW +BBRF66Kv9JLLgjEtUYunpyGd823IDzAfBgNVHSMEGDAWgBRF66Kv9JLLgjEtUYun +pyGd823IDzANBgkqhkiG9w0BAQUFAAOCAQEAog683+Lt8ONyc3pklL/3cmbYMuRC +dWKuh+vy1dneVrOfzM4UKLkNl2BcEkxY5NM9g0lFWJc1aRqoR+pWxnmrEthngYTf +fwk8lOa4JiwgvT2zKIn3X/8i4peEH+ll74fg38FnSbNd67IJKusm7Xi+fT8r87cm +NW1fiQG2SVufAQWbqz0lwcy2f8Lxb4bG+mRo64EtlOtCt/qMHt1i8b5QZ7dsvfPx +H2sMNgcWfzd8qVttevESRmCD1ycEvkvOl77DZypoEd+A5wwzZr8TDRRu838fYxAe ++o0bJW1sj6W3YQGx0qMmoRBxna3iw/nDmVG3KwcIzi7mULKn+gpFL6Lw8g== +-----END CERTIFICATE----- diff --git a/src/vidalia/res/DigiCertCA.crt b/src/vidalia/res/DigiCertCA.crt new file mode 100644 index 0000000..fd4341d --- /dev/null +++ b/src/vidalia/res/DigiCertCA.crt @@ -0,0 +1,22 @@ +-----BEGIN CERTIFICATE----- +MIIDrzCCApegAwIBAgIQCDvgVpBCRrGhdWrJWZHHSjANBgkqhkiG9w0BAQUFADBh +MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 +d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBD +QTAeFw0wNjExMTAwMDAwMDBaFw0zMTExMTAwMDAwMDBaMGExCzAJBgNVBAYTAlVT +MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j +b20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290IENBMIIBIjANBgkqhkiG +9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4jvhEXLeqKTTo1eqUKKPC3eQyaKl7hLOllsB +CSDMAZOnTjC3U/dDxGkAV53ijSLdhwZAAIEJzs4bg7/fzTtxRuLWZscFs3YnFo97 +nh6Vfe63SKMI2tavegw5BmV/Sl0fvBf4q77uKNd0f3p4mVmFaG5cIzJLv07A6Fpt +43C/dxC//AH2hdmoRBBYMql1GNXRor5H4idq9Joz+EkIYIvUX7Q6hL+hqkpMfT7P +T19sdl6gSzeRntwi5m3OFBqOasv+zbMUZBfHWymeMr/y7vrTC0LUq7dBMtoM1O/4 +gdW7jVg/tRvoSSiicNoxBN33shbyTApOB6jtSj1etX+jkMOvJwIDAQABo2MwYTAO +BgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUA95QNVbR +TLtm8KPiGxvDl7I90VUwHwYDVR0jBBgwFoAUA95QNVbRTLtm8KPiGxvDl7I90VUw +DQYJKoZIhvcNAQEFBQADggEBAMucN6pIExIK+t1EnE9SsPTfrgT1eXkIoyQY/Esr +hMAtudXH/vTBH1jLuG2cenTnmCmrEbXjcKChzUyImZOMkXDiqw8cvpOp/2PV5Adg +06O/nVsJ8dWO41P0jmP6P6fbtGbfYmbW0W5BjfIttep3Sp+dWOIrWcBAI+0tKIJF +PnlUkiaY4IBIqDfv8NZ5YBberOgOzW6sRBc4L0na4UU+Krk2U886UAb3LujEV0ls +YSEY1QSteDwsOoBrp+uvFRTp2InBuThs4pFsiv9kuXclVzDAGySj4dzp30d8tbQk +CAUw7C29C79Fv1C5qfPrmAESrciIxpg0X40KPMbp1ZWVbd4= +-----END CERTIFICATE----- diff --git a/src/vidalia/res/DigiCertHighAssuranceCA.crt b/src/vidalia/res/DigiCertHighAssuranceCA.crt new file mode 100644 index 0000000..9e6810a --- /dev/null +++ b/src/vidalia/res/DigiCertHighAssuranceCA.crt @@ -0,0 +1,23 @@ +-----BEGIN CERTIFICATE----- +MIIDxTCCAq2gAwIBAgIQAqxcJmoLQJuPC3nyrkYldzANBgkqhkiG9w0BAQUFADBs +MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 +d3cuZGlnaWNlcnQuY29tMSswKQYDVQQDEyJEaWdpQ2VydCBIaWdoIEFzc3VyYW5j +ZSBFViBSb290IENBMB4XDTA2MTExMDAwMDAwMFoXDTMxMTExMDAwMDAwMFowbDEL +MAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3 +LmRpZ2ljZXJ0LmNvbTErMCkGA1UEAxMiRGlnaUNlcnQgSGlnaCBBc3N1cmFuY2Ug +RVYgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMbM5XPm ++9S75S0tMqbf5YE/yc0lSbZxKsPVlDRnogocsF9ppkCxxLeyj9CYpKlBWTrT3JTW +PNt0OKRKzE0lgvdKpVMSOO7zSW1xkX5jtqumX8OkhPhPYlG++MXs2ziS4wblCJEM +xChBVfvLWokVfnHoNb9Ncgk9vjo4UFt3MRuNs8ckRZqnrG0AFFoEt7oT61EKmEFB +Ik5lYYeBQVCmeVyJ3hlKV9Uu5l0cUyx+mM0aBhakaHPQNAQTXKFx01p8VdteZOE3 +hzBWBOURtCmAEvF5OYiiAhF8J2a3iLd48soKqDirCmTCv2ZdlYTBoSUeh10aUAsg +EsxBu24LUTi4S8sCAwEAAaNjMGEwDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQF +MAMBAf8wHQYDVR0OBBYEFLE+w2kD+L9HAdSYJhoIAu9jZCvDMB8GA1UdIwQYMBaA +FLE+w2kD+L9HAdSYJhoIAu9jZCvDMA0GCSqGSIb3DQEBBQUAA4IBAQAcGgaX3Nec +nzyIZgYIVyHbIUf4KmeqvxgydkAQV8GK83rZEWWONfqe/EW1ntlMMUu4kehDLI6z +eM7b41N5cdblIZQB2lWHmiRk9opmzN6cN82oNLFpmyPInngiK3BD41VHMWEZ71jF +hS9OMPagMRYjyOfiZRYzy78aG6A9+MpeizGLYAiJLQwGXFK3xPkKmNEVX58Svnw2 +Yzi9RKR/5CYrCsSXaQ3pjOLAEFe4yHYSkVXySGnYvCoCWw9E1CAx2/S6cCZdkGCe +vEsXCS+0yx5DaMkHJ8HSXPfqIbloEpw8nL+e/IBcm2PN7EeqJSdnoDfzAIJ9VNep ++OkuE6N36B9K +-----END CERTIFICATE----- diff --git a/src/vidalia/res/vidalia.qrc b/src/vidalia/res/vidalia.qrc index 68f84aa..cfb1004 100644 --- a/src/vidalia/res/vidalia.qrc +++ b/src/vidalia/res/vidalia.qrc @@ -310,6 +310,9 @@ </qresource> <qresource prefix="/pki"> <file>EquifaxSecureCA.crt</file> + <file>DigiCertCA.crt</file> + <file>DigiCertAssuredCA.crt</file> + <file>DigiCertHighAssuranceCA.crt</file> </qresource> <qresource prefix="/geoip"> <file>country-coordinates.csv</file>

1 0

[vidalia/alpha] Fix paths for the new certificates
by chiiph＠torproject.org 03 May '11

03 May '11

commit 9406862b624f31821711c67e2da6ebca5438abc2 Author: Tomas Touceda <chiiph(a)gentoo.org> Date: Fri Apr 29 14:26:30 2011 -0300 Fix paths for the new certificates --- src/vidalia/Vidalia.cpp | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/vidalia/Vidalia.cpp b/src/vidalia/Vidalia.cpp index 5c22da3..91c6dfb 100644 --- a/src/vidalia/Vidalia.cpp +++ b/src/vidalia/Vidalia.cpp @@ -512,10 +512,10 @@ Vidalia::loadDefaultCaCertificates() const if (! QSslSocket::addDefaultCaCertificates(":/pki/DigiCertCA.crt")) vWarn("Failed to add the DigiCert Global CA certificate to the default CA " "certificate database."); - if (! QSslSocket::addDefaultCaCertificates(":/pki/DigiCertCA2.crt")) + if (! QSslSocket::addDefaultCaCertificates(":/pki/DigiCertAssuredCA.crt")) vWarn("Failed to add the DigiCert Assured CA certificate to the default CA " "certificate database."); - if (! QSslSocket::addDefaultCaCertificates(":/pki/DigiCertCA3.crt")) + if (! QSslSocket::addDefaultCaCertificates(":/pki/DigiCertHighAssuranceCA.crt")) vWarn("Failed to add the DigiCert High Assurance CA certificate to the default CA " "certificate database."); }

1 0

[vidalia/alpha] Merge branch 'bug2835_getbridges'
by chiiph＠torproject.org 03 May '11

03 May '11

commit d92bf67ec79ac110ef833bc4bccd9dede49ad2d6 Merge: 8d691c7 9406862 Author: Tomas Touceda <chiiph(a)gentoo.org> Date: Tue May 3 11:38:01 2011 -0300 Merge branch 'bug2835_getbridges' src/vidalia/Vidalia.cpp | 9 +++ src/vidalia/config/BridgeDownloader.cpp | 64 ++++++++------------ src/vidalia/config/BridgeDownloader.h | 17 ++--- .../config/BridgeDownloaderProgressDialog.cpp | 2 +- .../config/BridgeDownloaderProgressDialog.h | 2 +- src/vidalia/config/NetworkPage.cpp | 4 +- src/vidalia/res/DigiCertAssuredCA.crt | 22 +++++++ src/vidalia/res/DigiCertCA.crt | 22 +++++++ src/vidalia/res/DigiCertHighAssuranceCA.crt | 23 +++++++ src/vidalia/res/vidalia.qrc | 3 + 10 files changed, 116 insertions(+), 52 deletions(-)

1 0

[vidalia/alpha] Merge branch 'master' into alpha
by chiiph＠torproject.org 03 May '11

03 May '11

commit ec69a3999aed791d0a529f4c1ec283e1ead3f9f0 Merge: 8941866 d92bf67 Author: Tomas Touceda <chiiph(a)gentoo.org> Date: Tue May 3 11:38:12 2011 -0300 Merge branch 'master' into alpha src/vidalia/Vidalia.cpp | 9 +++ src/vidalia/config/BridgeDownloader.cpp | 64 ++++++++------------ src/vidalia/config/BridgeDownloader.h | 17 ++--- .../config/BridgeDownloaderProgressDialog.cpp | 2 +- .../config/BridgeDownloaderProgressDialog.h | 2 +- src/vidalia/config/NetworkPage.cpp | 4 +- src/vidalia/res/DigiCertAssuredCA.crt | 22 +++++++ src/vidalia/res/DigiCertCA.crt | 22 +++++++ src/vidalia/res/DigiCertHighAssuranceCA.crt | 23 +++++++ src/vidalia/res/vidalia.qrc | 3 + 10 files changed, 116 insertions(+), 52 deletions(-)

1 0

[vidalia/master] Port BridgeDownloader from QHttp to QtNetwork
by chiiph＠torproject.org 03 May '11

03 May '11

commit cbfe5e908026729818d91d2fbb17a92469574abd Author: Tomas Touceda <chiiph(a)gentoo.org> Date: Fri Apr 15 12:34:01 2011 -0300 Port BridgeDownloader from QHttp to QtNetwork QHttp is deprecated in the latest versions. Also, added a check for the certificate sha1 digest. --- src/vidalia/config/BridgeDownloader.cpp | 71 +++++++++----------- src/vidalia/config/BridgeDownloader.h | 17 ++--- .../config/BridgeDownloaderProgressDialog.cpp | 2 +- .../config/BridgeDownloaderProgressDialog.h | 2 +- src/vidalia/config/NetworkPage.cpp | 4 +- 5 files changed, 44 insertions(+), 52 deletions(-) diff --git a/src/vidalia/config/BridgeDownloader.cpp b/src/vidalia/config/BridgeDownloader.cpp index d70034d..15d73cb 100644 --- a/src/vidalia/config/BridgeDownloader.cpp +++ b/src/vidalia/config/BridgeDownloader.cpp @@ -16,34 +16,26 @@ #include "BridgeDownloader.h" #include "Vidalia.h" -#include <QSslSocket> - #define BRIDGEDB_HOST "bridges.torproject.org" #define BRIDGEDB_PORT 443 - +#define BRIDGEDB_SHA1 "a7e70f8a648fe04a9677f13eedf6f91b5f7f2e25" BridgeDownloader::BridgeDownloader(QObject *parent) - : QObject(parent), - _requestId(0) + : QObject(parent) { - _https = new QHttp(BRIDGEDB_HOST, QHttp::ConnectionModeHttps, - BRIDGEDB_PORT, this); - - connect(_https, SIGNAL(stateChanged(int)), - this, SLOT(httpsStateChanged(int))); - connect(_https, SIGNAL(requestFinished(int, bool)), - this, SLOT(httpsRequestFinished(int, bool))); - connect(_https, SIGNAL(dataReadProgress(int, int)), - this, SIGNAL(downloadProgress(int, int))); - connect(_https, SIGNAL(sslErrors(QList<QSslError>)), - this, SLOT(sslErrors(QList<QSslError>))); + _https = new QNetworkAccessManager(); + + connect(_https, SIGNAL(finished(QNetworkReply *)), + this, SLOT(httpsRequestFinished(QNetworkReply *))); + connect(_https, SIGNAL(sslErrors(QNetworkReply *, QList<QSslError>)), + this, SLOT(sslErrors(QNetworkReply *, QList<QSslError>))); } void BridgeDownloader::setProxy(const QString &host, int port, const QString &username, const QString &password) { - _https->setProxy(host, port, username, password); + _https->setProxy(QNetworkProxy(QNetworkProxy::HttpProxy, host, port, username, password)); } bool @@ -82,16 +74,18 @@ BridgeDownloader::startHttpsDownload() emit statusChanged(tr("Starting HTTPS bridge request...")); emit downloadProgress(0, 0); - _requestId = _https->get("/?format=plain"); - vInfo("Sending an HTTPS bridge request to %1:%2 (id %3).").arg(BRIDGEDB_HOST) - .arg(BRIDGEDB_PORT) - .arg(_requestId); + _reply = _https->get(QNetworkRequest(QUrl("https://bridges.torproject.org/?format=plain"))); + connect(_reply, SIGNAL(downloadProgress(qint64, qint64)), + this, SIGNAL(downloadProgress(qint64, qint64))); + vInfo("Sending an HTTPS bridge request to %1:%2.").arg(BRIDGEDB_HOST) + .arg(BRIDGEDB_PORT); } void BridgeDownloader::cancelBridgeRequest() { - _https->abort(); + _reply->close(); + disconnect(_reply, 0, 0, 0); } void @@ -117,20 +111,16 @@ BridgeDownloader::httpsStateChanged(int state) } void -BridgeDownloader::httpsRequestFinished(int id, bool error) +BridgeDownloader::httpsRequestFinished(QNetworkReply *reply) { - if (id != _requestId) - return; - - if (error) { - QString errorString = _https->errorString(); - vWarn("Bridge request failed (id %1): %2").arg(id).arg(errorString); + if (reply->error() != QNetworkReply::NoError) { + QString errorString = reply->errorString(); + vWarn("Bridge request failed: %2").arg(errorString); emit bridgeRequestFailed(errorString); } else { - QByteArray response = _https->readAll(); - vInfo("Bridge request complete (id %1): received %2 bytes.").arg(id) - .arg(response.size()); + QByteArray response = reply->readAll(); + vInfo("Bridge request complete: received %2 bytes.").arg(response.size()); QStringList bridges, lines = QString(response).split("\n"); foreach (QString line, lines) { @@ -140,22 +130,27 @@ BridgeDownloader::httpsRequestFinished(int id, bool error) } emit bridgeRequestFinished(bridges); } - _https->close(); + _reply->close(); + disconnect(_reply,0,0,0); } void -BridgeDownloader::sslErrors(const QList<QSslError> &sslErrors) +BridgeDownloader::sslErrors(QNetworkReply *reply, const QList<QSslError> &sslErrors) { QString errorString; QStringList errorStrings; - vWarn("%1 SSL error(s) when requesting bridge information (id %2):") - .arg(sslErrors.size()) - .arg(_requestId); + vWarn("%1 SSL error(s) when requesting bridge information:") + .arg(sslErrors.size()); foreach (QSslError sslError, sslErrors) { errorString = sslError.errorString(); errorStrings << errorString; vWarn(" SSL Error: %1").arg(errorString); } -} + // Check if the certificate is the one we expect + if(_reply->sslConfiguration().peerCertificate().digest(QCryptographicHash::Sha1)==QByteArray::fromHex(BRIDGEDB_SHA1)) { + _reply->ignoreSslErrors(); + } else + vWarn("There's been a problem with the certificate."); +} diff --git a/src/vidalia/config/BridgeDownloader.h b/src/vidalia/config/BridgeDownloader.h index 0cb87f4..cf30979 100644 --- a/src/vidalia/config/BridgeDownloader.h +++ b/src/vidalia/config/BridgeDownloader.h @@ -16,10 +16,7 @@ #ifndef _BRIDGEDOWNLOADER_H #define _BRIDGEDOWNLOADER_H -#include <QHttp> -#include <QSslError> -#include <QStringList> - +#include <QtNetwork> class BridgeDownloader : public QObject { @@ -65,7 +62,7 @@ signals: * have been read so far. Note that total may be 0 if the expected * total size of the response is not known. */ - void downloadProgress(int done, int total); + void downloadProgress(qint64 done, qint64 total); /** Emitted when the status of the bridge request changes. status * describes the new current state of the request. @@ -98,14 +95,14 @@ private slots: * signal is ignored since it is the result of a close() or abort() * request. */ - void httpsRequestFinished(int id, bool error); + void httpsRequestFinished(QNetworkReply *reply); /** Called when the HTTPS connection encounters one or more * sslErrors. Currently the errors are just logged and * bridgeRequestFailed() is not emitted, since QHttp will also * emit */ - void sslErrors(const QList<QSslError> &sslErrors); + void sslErrors(QNetworkReply *, const QList<QSslError> &sslErrors); private: /** Initiates an HTTPS connection to bridges.torproject.org to start @@ -115,10 +112,10 @@ private: /** Used to connect to the bridge database, send an HTTPS request for * new bridge addresses and then read the response. */ - QHttp* _https; + QNetworkAccessManager* _https; - /** Unique numeric identifier of the current bridge request. */ - int _requestId; + /** Identifier of the current bridge request */ + QNetworkReply *_reply; }; #endif diff --git a/src/vidalia/config/BridgeDownloaderProgressDialog.cpp b/src/vidalia/config/BridgeDownloaderProgressDialog.cpp index b4d8e28..f16daa8 100644 --- a/src/vidalia/config/BridgeDownloaderProgressDialog.cpp +++ b/src/vidalia/config/BridgeDownloaderProgressDialog.cpp @@ -46,7 +46,7 @@ BridgeDownloaderProgressDialog::setStatus(const QString &status) } void -BridgeDownloaderProgressDialog::setDownloadProgress(int done, int total) +BridgeDownloaderProgressDialog::setDownloadProgress(qint64 done, qint64 total) { ui.progressBar->setRange(0, total); ui.progressBar->setValue(done); diff --git a/src/vidalia/config/BridgeDownloaderProgressDialog.h b/src/vidalia/config/BridgeDownloaderProgressDialog.h index 86fb0d3..d9d505f 100644 --- a/src/vidalia/config/BridgeDownloaderProgressDialog.h +++ b/src/vidalia/config/BridgeDownloaderProgressDialog.h @@ -39,7 +39,7 @@ public slots: * maximum steps. If value and maximum are both 0, * then a "busy" progress bar is displayed. */ - void setDownloadProgress(int value, int maximum); + void setDownloadProgress(qint64 value, qint64 maximum); /** Called when the bridge download completes successfully and discards * the progress dialog with an Accept result code. bridges diff --git a/src/vidalia/config/NetworkPage.cpp b/src/vidalia/config/NetworkPage.cpp index f5bbc72..7154334 100644 --- a/src/vidalia/config/NetworkPage.cpp +++ b/src/vidalia/config/NetworkPage.cpp @@ -389,8 +389,8 @@ NetworkPage::findBridges() connect(_bridgeDownloader, SIGNAL(statusChanged(QString)), dlg, SLOT(setStatus(QString))); - connect(_bridgeDownloader, SIGNAL(downloadProgress(int, int)), - dlg, SLOT(setDownloadProgress(int, int))); + connect(_bridgeDownloader, SIGNAL(downloadProgress(qint64, qint64)), + dlg, SLOT(setDownloadProgress(qint64, qint64))); connect(_bridgeDownloader, SIGNAL(bridgeRequestFailed(QString)), dlg, SLOT(bridgeRequestFailed(QString))); connect(_bridgeDownloader, SIGNAL(bridgeRequestFinished(QStringList)),

1 0

[vidalia/master] Handle the validation by adding DigiCert's CAs
by chiiph＠torproject.org 03 May '11

03 May '11

commit 2470c0bda9923a67710fce2ed5fbcc03c3f018f2 Author: Tomas Touceda <chiiph(a)gentoo.org> Date: Thu Apr 28 13:20:46 2011 -0300 Handle the validation by adding DigiCert's CAs --- src/vidalia/Vidalia.cpp | 9 +++++++++ src/vidalia/config/BridgeDownloader.cpp | 7 ------- src/vidalia/res/DigiCertAssuredCA.crt | 22 ++++++++++++++++++++++ src/vidalia/res/DigiCertCA.crt | 22 ++++++++++++++++++++++ src/vidalia/res/DigiCertHighAssuranceCA.crt | 23 +++++++++++++++++++++++ src/vidalia/res/vidalia.qrc | 3 +++ 6 files changed, 79 insertions(+), 7 deletions(-) diff --git a/src/vidalia/Vidalia.cpp b/src/vidalia/Vidalia.cpp index f88c94f..5c22da3 100644 --- a/src/vidalia/Vidalia.cpp +++ b/src/vidalia/Vidalia.cpp @@ -509,5 +509,14 @@ Vidalia::loadDefaultCaCertificates() const if (! QSslSocket::addDefaultCaCertificates(":/pki/EquifaxSecureCA.crt")) vWarn("Failed to add the Equifax Secure CA certificate to the default CA " "certificate database."); + if (! QSslSocket::addDefaultCaCertificates(":/pki/DigiCertCA.crt")) + vWarn("Failed to add the DigiCert Global CA certificate to the default CA " + "certificate database."); + if (! QSslSocket::addDefaultCaCertificates(":/pki/DigiCertCA2.crt")) + vWarn("Failed to add the DigiCert Assured CA certificate to the default CA " + "certificate database."); + if (! QSslSocket::addDefaultCaCertificates(":/pki/DigiCertCA3.crt")) + vWarn("Failed to add the DigiCert High Assurance CA certificate to the default CA " + "certificate database."); } diff --git a/src/vidalia/config/BridgeDownloader.cpp b/src/vidalia/config/BridgeDownloader.cpp index 15d73cb..f1ac91a 100644 --- a/src/vidalia/config/BridgeDownloader.cpp +++ b/src/vidalia/config/BridgeDownloader.cpp @@ -18,7 +18,6 @@ #define BRIDGEDB_HOST "bridges.torproject.org" #define BRIDGEDB_PORT 443 -#define BRIDGEDB_SHA1 "a7e70f8a648fe04a9677f13eedf6f91b5f7f2e25" BridgeDownloader::BridgeDownloader(QObject *parent) : QObject(parent) @@ -147,10 +146,4 @@ BridgeDownloader::sslErrors(QNetworkReply *reply, const QList<QSslError> &sslErr errorStrings << errorString; vWarn(" SSL Error: %1").arg(errorString); } - - // Check if the certificate is the one we expect - if(_reply->sslConfiguration().peerCertificate().digest(QCryptographicHash::Sha1)==QByteArray::fromHex(BRIDGEDB_SHA1)) { - _reply->ignoreSslErrors(); - } else - vWarn("There's been a problem with the certificate."); } diff --git a/src/vidalia/res/DigiCertAssuredCA.crt b/src/vidalia/res/DigiCertAssuredCA.crt new file mode 100644 index 0000000..2731638 --- /dev/null +++ b/src/vidalia/res/DigiCertAssuredCA.crt @@ -0,0 +1,22 @@ +-----BEGIN CERTIFICATE----- +MIIDtzCCAp+gAwIBAgIQDOfg5RfYRv6P5WD8G/AwOTANBgkqhkiG9w0BAQUFADBl +MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 +d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJv +b3QgQ0EwHhcNMDYxMTEwMDAwMDAwWhcNMzExMTEwMDAwMDAwWjBlMQswCQYDVQQG +EwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNl +cnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJvb3QgQ0EwggEi +MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCtDhXO5EOAXLGH87dg+XESpa7c +JpSIqvTO9SA5KFhgDPiA2qkVlTJhPLWxKISKityfCgyDF3qPkKyK53lTXDGEKvYP +mDI2dsze3Tyoou9q+yHyUmHfnyDXH+Kx2f4YZNISW1/5WBg1vEfNoTb5a3/UsDg+ +wRvDjDPZ2C8Y/igPs6eD1sNuRMBhNZYW/lmci3Zt1/GiSw0r/wty2p5g0I6QNcZ4 +VYcgoc/lbQrISXwxmDNsIumH0DJaoroTghHtORedmTpyoeb6pNnVFzF1roV9Iq4/ +AUaG9ih5yLHa5FcXxH4cDrC0kqZWs72yl+2qp/C3xag/lRbQ/6GW6whfGHdPAgMB +AAGjYzBhMA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQW +BBRF66Kv9JLLgjEtUYunpyGd823IDzAfBgNVHSMEGDAWgBRF66Kv9JLLgjEtUYun +pyGd823IDzANBgkqhkiG9w0BAQUFAAOCAQEAog683+Lt8ONyc3pklL/3cmbYMuRC +dWKuh+vy1dneVrOfzM4UKLkNl2BcEkxY5NM9g0lFWJc1aRqoR+pWxnmrEthngYTf +fwk8lOa4JiwgvT2zKIn3X/8i4peEH+ll74fg38FnSbNd67IJKusm7Xi+fT8r87cm +NW1fiQG2SVufAQWbqz0lwcy2f8Lxb4bG+mRo64EtlOtCt/qMHt1i8b5QZ7dsvfPx +H2sMNgcWfzd8qVttevESRmCD1ycEvkvOl77DZypoEd+A5wwzZr8TDRRu838fYxAe ++o0bJW1sj6W3YQGx0qMmoRBxna3iw/nDmVG3KwcIzi7mULKn+gpFL6Lw8g== +-----END CERTIFICATE----- diff --git a/src/vidalia/res/DigiCertCA.crt b/src/vidalia/res/DigiCertCA.crt new file mode 100644 index 0000000..fd4341d --- /dev/null +++ b/src/vidalia/res/DigiCertCA.crt @@ -0,0 +1,22 @@ +-----BEGIN CERTIFICATE----- +MIIDrzCCApegAwIBAgIQCDvgVpBCRrGhdWrJWZHHSjANBgkqhkiG9w0BAQUFADBh +MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 +d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBD +QTAeFw0wNjExMTAwMDAwMDBaFw0zMTExMTAwMDAwMDBaMGExCzAJBgNVBAYTAlVT +MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j +b20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290IENBMIIBIjANBgkqhkiG +9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4jvhEXLeqKTTo1eqUKKPC3eQyaKl7hLOllsB +CSDMAZOnTjC3U/dDxGkAV53ijSLdhwZAAIEJzs4bg7/fzTtxRuLWZscFs3YnFo97 +nh6Vfe63SKMI2tavegw5BmV/Sl0fvBf4q77uKNd0f3p4mVmFaG5cIzJLv07A6Fpt +43C/dxC//AH2hdmoRBBYMql1GNXRor5H4idq9Joz+EkIYIvUX7Q6hL+hqkpMfT7P +T19sdl6gSzeRntwi5m3OFBqOasv+zbMUZBfHWymeMr/y7vrTC0LUq7dBMtoM1O/4 +gdW7jVg/tRvoSSiicNoxBN33shbyTApOB6jtSj1etX+jkMOvJwIDAQABo2MwYTAO +BgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUA95QNVbR +TLtm8KPiGxvDl7I90VUwHwYDVR0jBBgwFoAUA95QNVbRTLtm8KPiGxvDl7I90VUw +DQYJKoZIhvcNAQEFBQADggEBAMucN6pIExIK+t1EnE9SsPTfrgT1eXkIoyQY/Esr +hMAtudXH/vTBH1jLuG2cenTnmCmrEbXjcKChzUyImZOMkXDiqw8cvpOp/2PV5Adg +06O/nVsJ8dWO41P0jmP6P6fbtGbfYmbW0W5BjfIttep3Sp+dWOIrWcBAI+0tKIJF +PnlUkiaY4IBIqDfv8NZ5YBberOgOzW6sRBc4L0na4UU+Krk2U886UAb3LujEV0ls +YSEY1QSteDwsOoBrp+uvFRTp2InBuThs4pFsiv9kuXclVzDAGySj4dzp30d8tbQk +CAUw7C29C79Fv1C5qfPrmAESrciIxpg0X40KPMbp1ZWVbd4= +-----END CERTIFICATE----- diff --git a/src/vidalia/res/DigiCertHighAssuranceCA.crt b/src/vidalia/res/DigiCertHighAssuranceCA.crt new file mode 100644 index 0000000..9e6810a --- /dev/null +++ b/src/vidalia/res/DigiCertHighAssuranceCA.crt @@ -0,0 +1,23 @@ +-----BEGIN CERTIFICATE----- +MIIDxTCCAq2gAwIBAgIQAqxcJmoLQJuPC3nyrkYldzANBgkqhkiG9w0BAQUFADBs +MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 +d3cuZGlnaWNlcnQuY29tMSswKQYDVQQDEyJEaWdpQ2VydCBIaWdoIEFzc3VyYW5j +ZSBFViBSb290IENBMB4XDTA2MTExMDAwMDAwMFoXDTMxMTExMDAwMDAwMFowbDEL +MAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3 +LmRpZ2ljZXJ0LmNvbTErMCkGA1UEAxMiRGlnaUNlcnQgSGlnaCBBc3N1cmFuY2Ug +RVYgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMbM5XPm ++9S75S0tMqbf5YE/yc0lSbZxKsPVlDRnogocsF9ppkCxxLeyj9CYpKlBWTrT3JTW +PNt0OKRKzE0lgvdKpVMSOO7zSW1xkX5jtqumX8OkhPhPYlG++MXs2ziS4wblCJEM +xChBVfvLWokVfnHoNb9Ncgk9vjo4UFt3MRuNs8ckRZqnrG0AFFoEt7oT61EKmEFB +Ik5lYYeBQVCmeVyJ3hlKV9Uu5l0cUyx+mM0aBhakaHPQNAQTXKFx01p8VdteZOE3 +hzBWBOURtCmAEvF5OYiiAhF8J2a3iLd48soKqDirCmTCv2ZdlYTBoSUeh10aUAsg +EsxBu24LUTi4S8sCAwEAAaNjMGEwDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQF +MAMBAf8wHQYDVR0OBBYEFLE+w2kD+L9HAdSYJhoIAu9jZCvDMB8GA1UdIwQYMBaA +FLE+w2kD+L9HAdSYJhoIAu9jZCvDMA0GCSqGSIb3DQEBBQUAA4IBAQAcGgaX3Nec +nzyIZgYIVyHbIUf4KmeqvxgydkAQV8GK83rZEWWONfqe/EW1ntlMMUu4kehDLI6z +eM7b41N5cdblIZQB2lWHmiRk9opmzN6cN82oNLFpmyPInngiK3BD41VHMWEZ71jF +hS9OMPagMRYjyOfiZRYzy78aG6A9+MpeizGLYAiJLQwGXFK3xPkKmNEVX58Svnw2 +Yzi9RKR/5CYrCsSXaQ3pjOLAEFe4yHYSkVXySGnYvCoCWw9E1CAx2/S6cCZdkGCe +vEsXCS+0yx5DaMkHJ8HSXPfqIbloEpw8nL+e/IBcm2PN7EeqJSdnoDfzAIJ9VNep ++OkuE6N36B9K +-----END CERTIFICATE----- diff --git a/src/vidalia/res/vidalia.qrc b/src/vidalia/res/vidalia.qrc index 68f84aa..cfb1004 100644 --- a/src/vidalia/res/vidalia.qrc +++ b/src/vidalia/res/vidalia.qrc @@ -310,6 +310,9 @@ </qresource> <qresource prefix="/pki"> <file>EquifaxSecureCA.crt</file> + <file>DigiCertCA.crt</file> + <file>DigiCertAssuredCA.crt</file> + <file>DigiCertHighAssuranceCA.crt</file> </qresource> <qresource prefix="/geoip"> <file>country-coordinates.csv</file>

1 0

[vidalia/master] Fix paths for the new certificates
by chiiph＠torproject.org 03 May '11

03 May '11

commit 9406862b624f31821711c67e2da6ebca5438abc2 Author: Tomas Touceda <chiiph(a)gentoo.org> Date: Fri Apr 29 14:26:30 2011 -0300 Fix paths for the new certificates --- src/vidalia/Vidalia.cpp | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/vidalia/Vidalia.cpp b/src/vidalia/Vidalia.cpp index 5c22da3..91c6dfb 100644 --- a/src/vidalia/Vidalia.cpp +++ b/src/vidalia/Vidalia.cpp @@ -512,10 +512,10 @@ Vidalia::loadDefaultCaCertificates() const if (! QSslSocket::addDefaultCaCertificates(":/pki/DigiCertCA.crt")) vWarn("Failed to add the DigiCert Global CA certificate to the default CA " "certificate database."); - if (! QSslSocket::addDefaultCaCertificates(":/pki/DigiCertCA2.crt")) + if (! QSslSocket::addDefaultCaCertificates(":/pki/DigiCertAssuredCA.crt")) vWarn("Failed to add the DigiCert Assured CA certificate to the default CA " "certificate database."); - if (! QSslSocket::addDefaultCaCertificates(":/pki/DigiCertCA3.crt")) + if (! QSslSocket::addDefaultCaCertificates(":/pki/DigiCertHighAssuranceCA.crt")) vWarn("Failed to add the DigiCert High Assurance CA certificate to the default CA " "certificate database."); }

1 0