aboutsummaryrefslogtreecommitdiff
path: root/src/common/tortls.h
Commit message (Expand)AuthorAge
* Make certificate skew into a protocol warningNick Mathewson2011-11-15
* Allow up to a 30 days future skew, 48 hours past skew in certs.Nick Mathewson2011-11-15
* Fix a bunch of whitespace errorsNick Mathewson2011-10-11
* Make tor_tls_cert_is_valid check key lengthsNick Mathewson2011-10-10
* Function to return peer cert as tor_tls_certNick Mathewson2011-10-10
* Functions to get a public RSA key from a certNick Mathewson2011-10-10
* Function to detect certificate types that signal v3 certificatesNick Mathewson2011-10-10
* Function to get digests of the certs and their keysNick Mathewson2011-10-10
* More functions to manipulate certs received in cellsNick Mathewson2011-10-10
* Function to extract the TLSSECRETS field for v3 handshakesNick Mathewson2011-10-10
* Turn X509 certificates into a first-class type and add some functionsNick Mathewson2011-10-10
* Record the states of failing OR connections•••This code lets us record the state of any outgoing OR connection that fails before it becomes open, so we can notice if they're all dying in the same SSL state or the same OR handshake state. More work is still needed: - We need documentation - We need to actually call the code that reports the failure when we realize that we're having a hard time connecting out or making circuits. - We need to periodically clear out all this data -- perhaps, whenever we build a circuit successfully? - We'll eventually want to expose it to controllers, perhaps. Partial implementation of feature 3116. Nick Mathewson2011-07-11
* Merge remote branch 'origin/maint-0.2.2'Nick Mathewson2011-01-03
|\
| * Merge remote branch 'origin/maint-0.2.1' into maint-0.2.2•••Conflicts: src/common/test.h src/or/test.c Nick Mathewson2011-01-03
| |\
| | * Bump copyright statements to 2011Nick Mathewson2011-01-03
* | | Add a testing-only option to use bufferevent_openssl as a filter•••We need filtering bufferevent_openssl so that we can wrap around IOCP bufferevents on Windows. This patch adds a temporary option to turn on filtering mode, so that we can test it out on non-IOCP systems to make sure it hasn't got any surprising bugs. It also fixes some allocation/teardown errors in using bufferevent_openssl as a filter. Nick Mathewson2010-11-09
* | | Merge remote branch 'origin/maint-0.2.2'•••Conflicts: src/common/tortls.c Nick Mathewson2010-10-21
|\| |
| * | Maintain separate server and client TLS contexts.•••Fixes bug #988. Robert Ransom2010-10-04
| * | Refactor tor_tls_context_new:•••* Make tor_tls_context_new internal to tortls.c, and return the new tor_tls_context_t from it. * Add a public tor_tls_context_init wrapper function to replace it. Robert Ransom2010-10-04
| |/
* | Set OpenSSL 0.9.8l renegotiation flag early enough for bufferevents•••This seems to fix another case of bug2001. Nick Mathewson2010-10-12
* | Actually call connection_tls_finish_handshake() with bufferevents•••First start of a fix for bug2001, but my test network still isn't working: the client and the server send each other VERSIONS cells, but never notice that they got them. Nick Mathewson2010-10-12
* | Add header for tor_tls_log_one_errorNick Mathewson2010-10-11
* | Make the bufferevent code use the renegotiation-reenabling hackNick Mathewson2010-09-27
* | Document and/or fix stuff found by Sebastian in code review•••Thanks to Sebastian for his code-review of the bufferevents patch series.x Nick Mathewson2010-09-27
* | Get SSL connections and linked connections working with bufferevents.•••Clients are now verified to work and build circuits correctly. There are still a few warnings given here and there that I need to look into. Nick Mathewson2010-09-27
|/
* Update Tor Project copyright yearsNick Mathewson2010-02-27
* Make Tor work with OpenSSL 0.9.8l•••To fix a major security problem related to incorrect use of SSL/TLS renegotiation, OpenSSL has turned off renegotiation by default. We are not affected by this security problem, however, since we do renegotiation right. (Specifically, we never treat a renegotiated credential as authenticating previous communication.) Nevertheless, OpenSSL's new behavior requires us to explicitly turn renegotiation back on in order to get our protocol working again. Amusingly, this is not so simple as "set the flag when you create the SSL object" , since calling connect or accept seems to clear the flags. For belt-and-suspenders purposes, we clear the flag once the Tor handshake is done. There's no way to exploit a second handshake either, but we might as well not allow it. Nick Mathewson2009-11-05
* Fix compile warnings on Snow Leopard•••Big thanks to nickm and arma for helping me with this! Sebastian Hahn2009-09-01
* Update copyright to 2009.Karsten Loesing2009-05-04
* Remove svn $Id$s from our source, and remove tor --version --version.•••The subversion $Id$ fields made every commit force a rebuild of whatever file got committed. They were not actually useful for telling the version of Tor files in the wild. svn:r17867 Nick Mathewson2009-01-04
* Use a consistent naming standard for header file guard macros, taking care no...•••svn:r17805 Nick Mathewson2008-12-29
* Downlgrade tweak, and answer lots of XXX021s. No actual code fixes in this p...•••svn:r17686 Nick Mathewson2008-12-18
* Resolve many DOCDOCs.•••svn:r17662 Nick Mathewson2008-12-17
* r15161@31-33-107: nickm | 2008-04-10 11:11:58 -0400••• Make dumpstats() log the size and fullness of openssl-internal buffers, so I can test my hypothesis that many of them are empty, and my alternative hypothesis that many of them are mostly empty, against the null hypothesis that we really need to be burning 32K per open OR connection on this. svn:r14350 Nick Mathewson2008-04-10
* r14362@31-33-219: nickm | 2008-02-21 11:01:10 -0500••• Change some of our log messages related to closed TLS connections in order to better reflect reality. svn:r13657 Nick Mathewson2008-02-21
* r18218@catbus: nickm | 2008-02-19 17:27:40 -0500••• When SafeLogging is off, have TLS errors and messages logged with their associated addresses. svn:r13591 Nick Mathewson2008-02-19
* r18051@catbus: nickm | 2008-02-12 15:20:43 -0500••• Re-tune mempool parametes based on testing on peacetime: use smaller chuncks, free them a little more aggressively, and try very hard to concentrate allocations on fuller chunks. Also, lots of new documentation. svn:r13484 Nick Mathewson2008-02-12
* r14062@tombo: nickm | 2008-02-08 15:17:07 -0500••• Change DNs in x509 certificates to be harder to fingerprint. Raise common code. Refactor random hostname generation into crypto.c svn:r13429 Nick Mathewson2008-02-08
* Update some copyright notices: it is now 2008.•••svn:r13412 Nick Mathewson2008-02-07
* r17955@catbus: nickm | 2008-02-06 16:53:07 -0500••• The SSL portion of the revised handshake now seems to work: I just finally got a client and a server to negotiate versions. Now to make sure certificate verification is really happening, connections are getting opened, etc. svn:r13409 Nick Mathewson2008-02-06
* r17947@catbus: nickm | 2008-02-06 11:57:53 -0500••• Fix a bunch of DOCDOC items; document the --quiet flag; refactor a couple of XXXX020 items. svn:r13405 Nick Mathewson2008-02-06
* r17918@catbus: nickm | 2008-02-05 16:39:17 -0500••• Remove a few #if-0d items. svn:r13392 Nick Mathewson2008-02-05
* r17903@catbus: nickm | 2008-02-05 14:40:03 -0500••• Remove some dead code; fix some XXX020s; turn some XXX020s into XXXX_IP6s (i.e., "needs to be fixed when we add ipv6 support"). svn:r13382 Nick Mathewson2008-02-05
* clean up copyrights, and assign 2007 copyrights to The Tor Project, Inc•••svn:r12786 Roger Dingledine2007-12-12
* r15088@tombo: nickm | 2007-11-30 23:47:29 -0500••• Add support to get a callback invoked when the client renegotiate a connection. Also, make clients renegotiate. (not enabled yet, until they detect that the server acted like a v2 server) svn:r12623 Nick Mathewson2007-12-01
* r15087@tombo: nickm | 2007-11-30 22:32:26 -0500••• Start getting freaky with openssl callbacks in tortls.c: detect client ciphers, and if the list doesn't look like the list current Tors use, present only a single cert do not ask for a client cert. Also, support for client-side renegotiation. None of this is enabled unless you define V2_HANDSHAKE_SERVER. svn:r12622 Nick Mathewson2007-12-01
* r16669@catbus: nickm | 2007-11-14 14:50:03 -0500••• When we complete an OR handshake, set up all the internal fields and mark the connection as open. svn:r12495 Nick Mathewson2007-11-14
* r16523@catbus: nickm | 2007-11-07 11:35:49 -0500••• Improve "tls error. breaking" message a little. svn:r12411 Nick Mathewson2007-11-07
* r16455@catbus: nickm | 2007-11-06 12:48:00 -0500••• Parse CERT cells and act correctly when we get them. svn:r12396 Nick Mathewson2007-11-06
* r16432@catbus: nickm | 2007-11-05 14:18:57 -0500••• Send and parse link_auth cells properly. svn:r12386 Nick Mathewson2007-11-05
generated by cgit v1.2.3 (git 2.48.1) at 2025-03-24 07:44:08 +0000