aboutsummaryrefslogtreecommitdiff
path: root/src/common/tortls.c
Commit message (Expand)AuthorAge
* Make the bufferevent code use the renegotiation-reenabling hackNick Mathewson2010-09-27
* Always defer bufferevent_openssl callbacks to avoid reentrant invocationsNick Mathewson2010-09-27
* Fix whitespace in bufferevents branchNick Mathewson2010-09-27
* Document and/or fix stuff found by Sebastian in code review•••Thanks to Sebastian for his code-review of the bufferevents patch series.x Nick Mathewson2010-09-27
* Some bufferevents related fixes and pointers for nickmSebastian Hahn2010-09-27
* Convert bufferevents to use rate-limiting.•••This requires the latest Git version of Libevent as of 24 March 2010. In the future, we'll just say it requires Libevent 2.0.5-alpha or later. Since Libevent doesn't yet support hierarchical rate limit groups, there isn't yet support for tracking relayed-bytes separately when using the bufferevent system. If a future version does add support for hierarchical buckets, we can add that back in. Nick Mathewson2010-09-27
* Documentation for a few bufferevent functions.Nick Mathewson2010-09-27
* Get SSL connections and linked connections working with bufferevents.•••Clients are now verified to work and build circuits correctly. There are still a few warnings given here and there that I need to look into. Nick Mathewson2010-09-27
* Fix compilation with mingw and OpenSSL 0.9.8m+mingw-san2010-07-26
* Rename log.h to torlog.h•••This should make us conflict less with system files named "log.h". Yes, we shouldn't have been conflicting with those anyway, but some people's compilers act very oddly. The actual change was done with one "git mv", by editing Makefile.am, and running find . -name '*.[ch]' | xargs perl -i -pe 'if (/^#include.*\Wlog.h/) {s/log.h/torlog.h/; }' Nick Mathewson2010-07-09
* moved wince related includes and defs to compat.h where possible, removed unu...valerino2010-05-24
* Demote a warning about missing client ciphersSebastian Hahn2010-04-20
* minor cleanupsRoger Dingledine2010-04-20
* Merge commit 'origin/maint-0.2.1'Nick Mathewson2010-04-15
|\
| * Fix renegotiation on OpenSSL versions that backport RFC5746.•••Our code assumed that any version of OpenSSL before 0.9.8l could not possibly require SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION. This is so... except that many vendors have backported the flag from later versions of openssl when they backported the RFC5476 renegotiation feature. The new behavior is particularly annoying to detect. Previously, leaving SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION unset meant that clients would fail to renegotiate. People noticed that one fast! Now, OpenSSL's RFC5476 support means that clients will happily talk to any servers there are, but servers won't accept renegotiation requests from unpatched clients unless SSL_OP_ALLOW_etc is set. More fun: servers send back a "no renegotiation for you!" error, which unpatched clients respond to by stalling, and generally producing no useful error message. This might not be _the_ cause of bug 1346, but it is quite likely _a_ cause for bug 1346. Nick Mathewson2010-04-13
* | Merge remote branch 'origin/maint-0.2.1'•••Conflicts: src/common/test.h src/or/test.c Nick Mathewson2010-02-27
|\|
| * Update Tor Project copyright yearsNick Mathewson2010-02-27
* | fix typo and garbage grammarRoger Dingledine2010-02-21
* | Merge remote branch 'origin/maint-0.2.1'•••Conflicts: ChangeLog configure.in contrib/tor-mingw.nsi.in src/win32/orconfig.h Nick Mathewson2010-02-18
|\|
| * Fix compileSebastian Hahn2010-02-18
| * Even more conservative option-setting for SSL renegotiation.•••This time, set the SSL3_FLAGS_ALLOW_UNSAFE_RENEGOTIATION flag on every version before OpenSSL 0.9.8l. I can confirm that the option value (0x0010) wasn't reused until OpenSSL 1.0.0beta3. Nick Mathewson2010-02-17
* | Merge remote branch 'origin/maint-0.2.1'Nick Mathewson2010-01-31
|\|
| * Revise OpenSSL fix to work with OpenSSL 1.0.0beta*•••In brief: you mustn't use the SSL3_FLAG solution with anything but 0.9.8l, and you mustn't use the SSL_OP solution with anything before 0.9.8m, and you get in _real_ trouble if you try to set the flag in 1.0.0beta, since they use it for something different. For the ugly version, see my long comment in tortls.c Nick Mathewson2010-01-31
| * Decide whether to use SSL flags based on runtime OpenSSL version.•••We need to do this because Apple doesn't update its dev-tools headers when it updates its libraries in a security patch. On the bright side, this might get us out of shipping a statically linked OpenSSL on OSX. May fix bug 1225. [backported] Nick Mathewson2010-01-29
* | Detect the correct versions of openssl for tls negotiation fix•••Since it doesn't seem to hurt, we should use _both_ fixes whenever we see OpenSSL 0.9.7L .. 0.9.8, or OpenSSL 0.9.8L.. Nick Mathewson2010-01-29
* | Decide whether to use SSL flags based on runtime OpenSSL version.•••We need to do this because Apple doesn't update its dev-tools headers when it updates its libraries in a security patch. On the bright side, this might get us out of shipping a statically linked OpenSSL on OSX. May fix bug 1225. Nick Mathewson2010-01-29
* | Merge remote branch 'origin/maint-0.2.1'Nick Mathewson2010-01-23
|\|
| * Avoid a possible crash in tls_log_errors.•••We were checking for msg==NULL, but not lib or proc. This case can only occur if we have an error whose string we somehow haven't loaded, but it's worth coding defensively here. Spotted by rieo on IRC. Nick Mathewson2010-01-22
* | Now that FOO_free(NULL) always works, remove checks before calling it.Nick Mathewson2009-12-12
* | *_free functions now accept NULL•••Some *_free functions threw asserts when passed NULL. Now all of them accept NULL as input and perform no action when called that way. This gains us consistence for our free functions, and allows some code simplifications where an explicit null check is no longer necessary. Sebastian Hahn2009-12-12
* | Merge commit 'origin/maint-0.2.1'Nick Mathewson2009-12-04
|\|
| * Improved workaround for disabled OpenSSL renegotiation.•••It turns out that OpenSSL 0.9.8m is likely to take a completely different approach for reenabling renegotiation than OpenSSL 0.9.8l did, so we need to work with both. :p Fixes bug 1158. (patch by coderman; commit message by nickm) Martin Peck2009-12-04
* | Merge commit 'origin/maint-0.2.1'•••Conflicts: src/common/tortls.c Nick Mathewson2009-11-06
|\|
| * Make Tor work with OpenSSL 0.9.8l•••To fix a major security problem related to incorrect use of SSL/TLS renegotiation, OpenSSL has turned off renegotiation by default. We are not affected by this security problem, however, since we do renegotiation right. (Specifically, we never treat a renegotiated credential as authenticating previous communication.) Nevertheless, OpenSSL's new behavior requires us to explicitly turn renegotiation back on in order to get our protocol working again. Amusingly, this is not so simple as "set the flag when you create the SSL object" , since calling connect or accept seems to clear the flags. For belt-and-suspenders purposes, we clear the flag once the Tor handshake is done. There's no way to exploit a second handshake either, but we might as well not allow it. Nick Mathewson2009-11-05
* | Fix compilation on OpenSSLs with unusual state lists.•••"Unusual" in this context means "not the same as nickm's." We should grow a better list later. (Also, move TLS state table to a separate header.) Nick Mathewson2009-09-24
* | Debugging logs for TLS handshake•••The big change is to add a function to display the current SSL handshake state, and to log it everywhere reasonable. (A failure in SSL23_ST_CR_SRVR_HELLO_A is different from one in SSL3_ST_CR_SESSION_TICKET_A.) This patch also adds a new log domain for OR handshaking, so you can pull out all the handshake log messages without having to run at debug for everything. For example, you'd just say "log notice-err [handshake]debug-err file tor.log". Nick Mathewson2009-09-24
* | Merge commit 'origin/maint-0.2.1'Nick Mathewson2009-09-17
|\|
| * Work around a memory leak in openssl 0.9.8g (and maybe others)Nick Mathewson2009-09-17
* | Merge commit 'origin/maint-0.2.1'Nick Mathewson2009-09-01
|\|
| * Fix compile warnings on Snow Leopard•••Big thanks to nickm and arma for helping me with this! Sebastian Hahn2009-09-01
* | Merge branch 'hardware_accel_improvements'Nick Mathewson2009-05-31
|\ \ | |/ |/|
| * Add support for dynamic OpenSSL hardware crypto acceleration engines.Martin Peck2009-05-23
| * Update copyright to 2009.Karsten Loesing2009-05-02
* | Spelling fixes in comments and stringsNick Mathewson2009-05-27
* | Update copyright to 2009.Karsten Loesing2009-05-04
|/
* doxygen tweak•••svn:r18818 Roger Dingledine2009-03-09
* Remove svn $Id$s from our source, and remove tor --version --version.•••The subversion $Id$ fields made every commit force a rebuild of whatever file got committed. They were not actually useful for telling the version of Tor files in the wild. svn:r17867 Nick Mathewson2009-01-04
* Remove some code that is #ifdefed out, and that we no longer seem to use, if ...•••svn:r17827 Nick Mathewson2008-12-30
* Fix a small memory leak of around 32 bytes per TLS connection opened. Bugfix ...•••svn:r17678 Nick Mathewson2008-12-18
* Resolve many DOCDOCs.•••svn:r17662 Nick Mathewson2008-12-17
generated by cgit v1.2.3 (git 2.47.1) at 2025-03-20 03:50:32 +0000