[tor-commits] [tor/master] Merge branch 'maint-0.2.2_secfix' into master_secfix
arma at torproject.org
arma at torproject.org
Thu Oct 27 23:52:44 UTC 2011
commit 2dec6597af4014eb731d8caac55a8a87964ce371
Merge: 2c4e89b 4684ced
Author: Sebastian Hahn <sebastian at torproject.org>
Date: Thu Oct 27 00:15:25 2011 +0200
Merge branch 'maint-0.2.2_secfix' into master_secfix
Conflicts:
src/common/tortls.c
src/or/connection_or.c
src/or/dirserv.c
src/or/or.h
changes/issue-2011-10-19L | 28 +++++++++++
changes/issue-2011-10-23G | 9 +++
src/common/tortls.c | 119 +++++++++++++++++++++++++--------------------
src/or/command.c | 13 ++++-
src/or/config.c | 2 +
src/or/connection_or.c | 7 +++
src/or/dirserv.c | 79 ++++++++++++++++++++++++++++-
src/or/or.h | 10 ++++
src/or/routerparse.c | 3 +-
src/or/routerparse.h | 1 +
10 files changed, 212 insertions(+), 59 deletions(-)
diff --cc src/common/tortls.c
index a8b6085,352c3d6..7aaa4e0
--- a/src/common/tortls.c
+++ b/src/common/tortls.c
@@@ -204,13 -189,14 +204,15 @@@ static X509* tor_tls_create_certificate
const char *cname,
const char *cname_sign,
unsigned int lifetime);
-static void tor_tls_unblock_renegotiation(tor_tls_t *tls);
+
static int tor_tls_context_init_one(tor_tls_context_t **ppcontext,
crypto_pk_env_t *identity,
- unsigned int key_lifetime);
+ unsigned int key_lifetime,
+ int is_client);
static tor_tls_context_t *tor_tls_context_new(crypto_pk_env_t *identity,
- unsigned int key_lifetime);
+ unsigned int key_lifetime,
+ int is_client);
+static int check_cert_lifetime_internal(const X509 *cert, int tolerance);
/** Global TLS contexts. We keep them here because nobody else needs
* to touch them. */
@@@ -1085,12 -727,13 +1091,13 @@@ tor_tls_context_init_one(tor_tls_contex
* certificate.
*/
static tor_tls_context_t *
- tor_tls_context_new(crypto_pk_env_t *identity, unsigned int key_lifetime)
+ tor_tls_context_new(crypto_pk_env_t *identity, unsigned int key_lifetime,
+ int is_client)
{
- crypto_pk_env_t *rsa = NULL;
+ crypto_pk_env_t *rsa = NULL, *rsa_auth = NULL;
EVP_PKEY *pkey = NULL;
tor_tls_context_t *result = NULL;
- X509 *cert = NULL, *idcert = NULL;
+ X509 *cert = NULL, *idcert = NULL, *authcert = NULL;
char *nickname = NULL, *nn2 = NULL;
tor_tls_init();
@@@ -1106,35 -745,26 +1113,39 @@@
goto error;
if (crypto_pk_generate_key(rsa)<0)
goto error;
- /* Generate short-term RSA key for use in the in-protocol ("v3")
- * authentication handshake. */
- if (!(rsa_auth = crypto_new_pk_env()))
- goto error;
- if (crypto_pk_generate_key(rsa_auth)<0)
- goto error;
- /* Create a link certificate signed by identity key. */
- cert = tor_tls_create_certificate(rsa, identity, nickname, nn2,
- key_lifetime);
- /* Create self-signed certificate for identity key. */
- idcert = tor_tls_create_certificate(identity, identity, nn2, nn2,
- IDENTITY_CERT_LIFETIME);
- /* Create an authentication certificate signed by identity key. */
- authcert = tor_tls_create_certificate(rsa_auth, identity, nickname, nn2,
- key_lifetime);
- if (!cert || !idcert || !authcert) {
- log(LOG_WARN, LD_CRYPTO, "Error creating certificate");
- goto error;
+ if (!is_client) {
- /* Create certificate signed by identity key. */
++ /* Generate short-term RSA key for use in the in-protocol ("v3")
++ * authentication handshake. */
++ if (!(rsa_auth = crypto_new_pk_env()))
++ goto error;
++ if (crypto_pk_generate_key(rsa_auth)<0)
++ goto error;
++ /* Create a link certificate signed by identity key. */
+ cert = tor_tls_create_certificate(rsa, identity, nickname, nn2,
+ key_lifetime);
+ /* Create self-signed certificate for identity key. */
+ idcert = tor_tls_create_certificate(identity, identity, nn2, nn2,
+ IDENTITY_CERT_LIFETIME);
- if (!cert || !idcert) {
++ /* Create an authentication certificate signed by identity key. */
++ authcert = tor_tls_create_certificate(rsa_auth, identity, nickname, nn2,
++ key_lifetime);
++ if (!cert || !idcert || !authcert) {
+ log(LOG_WARN, LD_CRYPTO, "Error creating certificate");
+ goto error;
+ }
}
result = tor_malloc_zero(sizeof(tor_tls_context_t));
result->refcnt = 1;
- result->my_link_cert = tor_cert_new(X509_dup(cert));
- result->my_id_cert = tor_cert_new(X509_dup(idcert));
- result->my_auth_cert = tor_cert_new(X509_dup(authcert));
- if (!result->my_link_cert || !result->my_id_cert || !result->my_auth_cert)
- goto error;
- result->link_key = crypto_pk_dup_key(rsa);
- result->auth_key = crypto_pk_dup_key(rsa_auth);
+ if (!is_client) {
- result->my_cert = X509_dup(cert);
- result->my_id_cert = X509_dup(idcert);
- result->key = crypto_pk_dup_key(rsa);
++ result->my_link_cert = tor_cert_new(X509_dup(cert));
++ result->my_id_cert = tor_cert_new(X509_dup(idcert));
++ result->my_auth_cert = tor_cert_new(X509_dup(authcert));
++ if (!result->my_link_cert || !result->my_id_cert || !result->my_auth_cert)
++ goto error;
++ result->link_key = crypto_pk_dup_key(rsa);
++ result->auth_key = crypto_pk_dup_key(rsa_auth);
+ }
#ifdef EVERYONE_HAS_AES
/* Tell OpenSSL to only use TLS1 */
diff --cc src/or/command.c
index c85b057,1fa8bc6..d35e2a9
--- a/src/or/command.c
+++ b/src/or/command.c
@@@ -316,6 -232,7 +316,7 @@@ static voi
command_process_create_cell(cell_t *cell, or_connection_t *conn)
{
or_circuit_t *circ;
- or_options_t *options = get_options();
++ const or_options_t *options = get_options();
int id_is_high;
if (we_are_hibernating()) {
diff --cc src/or/config.c
index c5322f5,78e4336..1b9f9fb
--- a/src/or/config.c
+++ b/src/or/config.c
@@@ -282,9 -269,10 +282,11 @@@ static config_var_t _option_vars[] =
V(GeoIPFile, FILENAME,
SHARE_DATADIR PATH_SEPARATOR "tor" PATH_SEPARATOR "geoip"),
#endif
+ V(GiveGuardFlagTo_CVE_2011_2768_VulnerableRelays,
+ BOOL, "0"),
OBSOLETE("Group"),
V(HardwareAccel, BOOL, "0"),
+ V(HeartbeatPeriod, INTERVAL, "6 hours"),
V(AccelName, STRING, NULL),
V(AccelDir, FILENAME, NULL),
V(HashedControlPassword, LINELIST, NULL),
diff --cc src/or/connection_or.c
index 14da698,27a34d3..4c0960c
--- a/src/or/connection_or.c
+++ b/src/or/connection_or.c
@@@ -1031,20 -813,21 +1036,22 @@@ connection_or_connect(const tor_addr_t
conn->_base.state = OR_CONN_STATE_CONNECTING;
control_event_or_conn_status(conn, OR_CONN_EVENT_LAUNCHED, 0);
+ conn->is_outgoing = 1;
+
- /* use a proxy server if available */
- if (options->HTTPSProxy) {
- using_proxy = 1;
- tor_addr_copy(&addr, &options->HTTPSProxyAddr);
- port = options->HTTPSProxyPort;
- } else if (options->Socks4Proxy) {
- using_proxy = 1;
- tor_addr_copy(&addr, &options->Socks4ProxyAddr);
- port = options->Socks4ProxyPort;
- } else if (options->Socks5Proxy) {
- using_proxy = 1;
- tor_addr_copy(&addr, &options->Socks5ProxyAddr);
- port = options->Socks5ProxyPort;
+ /* If we are using a proxy server, find it and use it. */
+ r = get_proxy_addrport(&proxy_addr, &proxy_port, &proxy_type, TO_CONN(conn));
+ if (r == 0) {
+ conn->proxy_type = proxy_type;
+ if (proxy_type != PROXY_NONE) {
+ tor_addr_copy(&addr, &proxy_addr);
+ port = proxy_port;
+ conn->_base.proxy_state = PROXY_INFANT;
+ }
+ } else {
+ log_warn(LD_GENERAL, "Tried to connect through proxy, but proxy address "
+ "could not be found.");
+ connection_free(TO_CONN(conn));
+ return NULL;
}
switch (connection_connect(TO_CONN(conn), conn->_base.address,
diff --cc src/or/dirserv.c
index 5cb4aba,c427fe2..288fca9
--- a/src/or/dirserv.c
+++ b/src/or/dirserv.c
@@@ -2333,9 -2363,13 +2402,13 @@@ set_routerstatus_from_routerinfo(router
(router_get_advertised_bandwidth(ri) >= BANDWIDTH_TO_GUARANTEE_GUARD ||
router_get_advertised_bandwidth(ri) >=
MIN(guard_bandwidth_including_exits,
- guard_bandwidth_excluding_exits))) {
- long tk = rep_hist_get_weighted_time_known(node->identity, now);
- double wfu = rep_hist_get_weighted_fractional_uptime(node->identity, now);
+ guard_bandwidth_excluding_exits)) &&
+ (options->GiveGuardFlagTo_CVE_2011_2768_VulnerableRelays ||
+ is_router_version_good_for_possible_guard(ri->platform))) {
+ long tk = rep_hist_get_weighted_time_known(
- ri->cache_info.identity_digest, now);
++ node->identity, now);
+ double wfu = rep_hist_get_weighted_fractional_uptime(
- ri->cache_info.identity_digest, now);
++ node->identity, now);
rs->is_possible_guard = (wfu >= guard_wfu && tk >= guard_tk) ? 1 : 0;
} else {
rs->is_possible_guard = 0;
diff --cc src/or/or.h
index 7a901e7,7d50e1f..e4f9b9b
--- a/src/or/or.h
+++ b/src/or/or.h
@@@ -1220,7 -1068,12 +1220,13 @@@ typedef struct or_connection_t
* router itself has a problem.
*/
unsigned int is_bad_for_new_circs:1;
+ /** True iff we have decided that the other end of this connection
+ * is a client. Connections with this flag set should never be used
+ * to satisfy an EXTEND request. */
+ unsigned int is_connection_with_client:1;
+ /** True iff this is an outgoing connection. */
+ unsigned int is_outgoing:1;
+ unsigned int proxy_type:2; /**< One of PROXY_NONE...PROXY_SOCKS5 */
uint8_t link_proto; /**< What protocol version are we using? 0 for
* "none negotiated yet." */
circid_t next_circ_id; /**< Which circ_id do we try to use next on
More information about the tor-commits
mailing list