summaryrefslogtreecommitdiff
path: root/src/common/tortls.c
AgeCommit message (Collapse)Author
2018-03-26Merge branch 'bug24658-rm-curve25519-header' into bug24658-mergeNick Mathewson
2018-02-10Merge branch 'maint-0.3.2'Nick Mathewson
2018-02-10Merge branch 'maint-0.3.1' into maint-0.3.2Nick Mathewson
2018-02-10Merge branch 'maint-0.2.9' into maint-0.3.1Nick Mathewson
2018-02-07Fix spelling mistakes corresponding to ticket #23650Deepesh Pathak
2018-02-03Include crypto_digest.h in order to solve dependency issues.Fernando Fernandez Mancera
Included crypto_digest.h in some files in order to solve xof+digest module dependency issues. Removed crypto.h where it isn't needed anymore. Follows #24658. Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net>
2018-01-23Make Tor support TLS1.3 ciphers with OpenSSL 1.1.1Nick Mathewson
Without this patch, not only will TLS1.3 not work with Tor, but OpenSSL 1.1.1 with TLS1.3 enabled won't build any connections at all: It requires that either TLS1.3 be disabled, or some TLS1.3 ciphersuites be listed. Closes ticket 24978.
2017-12-20Merge branch 'maint-0.3.2'Nick Mathewson
2017-12-13Another attempt at fixing the STACK warning in tortls.cNick Mathewson
Patch suggestion from catalyst. Related to 24423
2017-11-17Make all the crypto free() functions macros that clear their targetsNick Mathewson
2017-09-28Move around some LCOV_EXCLs in src/commonNick Mathewson
Apparently, my compiler now generates coverage markers for label-only lines, so we need to exclude those too if they are meant to be unreachable.
2017-09-15Run our #else/#endif annotator on our source code.Nick Mathewson
2017-08-25Merge branch 'maint-0.3.1'Nick Mathewson
2017-08-25Merge branch 'bug19418_029' into maint-0.3.1Nick Mathewson
2017-08-09Make sure we always wind up checking i2d_*'s output.Nick Mathewson
The biggest offender here was sometimes not checking the output of crypto_pk_get_digest. Fixes bug 19418. Reported by Guido Vranken.
2017-07-24Improve comment about why we disable TLS compression.Nick Mathewson
Closes bug 22964. Based on Teor's replacement there, but tries to put the comment in a more logical place, and explain why we're actually disabling compression in the first place.
2017-06-05Merge branch 'maint-0.3.0'Nick Mathewson
2017-06-05Merge branch 'maint-0.2.9' into maint-0.3.0Nick Mathewson
2017-06-05Improve documentation on get_{peer,own}_certificate()Nick Mathewson
Make it clear that we're returning a newly allocated copy.
2017-06-05Test prerequisites: function to dup a cert, make get_own_cert mockable.Nick Mathewson
2017-06-05On v3 link handshake, send the correct link certificateNick Mathewson
Previously we'd send the _current_ link certificate, which would cause a handshaking failure when the TLS context rotated.
2017-05-26Cleanup MOCK_IMPL (etc) to be findable with etagsNick Mathewson
A fair number of our mock_impl declarations were messed up so that even our special AM_ETAGSFLAGS couldn't find them. This should be a whitespace-only patch.
2017-03-31Move "change cert expiration and re-sign" fn into tortls.cNick Mathewson
This lets test_link_handshake stop including openssl headers.
2017-03-31Change many tortls.h declarations of private APIs to use structsNick Mathewson
This change makes it so those those APIs will not require prior inclusion of openssl headers. I've left some APIs alone-- those will change to be extra-private.
2017-03-15Run the copyright update script.Nick Mathewson
2017-02-27Merge branch 'bug21420_029_squashed' into maint-0.3.0Nick Mathewson
2017-02-27Revise the logic for picking the start time for link certsNick Mathewson
Since 0.2.4.11-alpha (in 0196647970a91d) we've tried to randomize the start time to up to some time in the past. But unfortunately we allowed the start time to be in the future as well, which isn't really legit. The new behavior lets the start time be be up to MAX(cert_lifetime-2days, 0) in the past, but never in the future. Fixes bug 21420; bugfix on 0.2.4.11-alpha.
2017-01-24Re-run gen_server_ciphersNick Mathewson
2016-11-03Merge branch 'maint-0.2.8' into maint-0.2.9Nick Mathewson
2016-11-03Merge branch 'bug20551_028'Nick Mathewson
2016-11-03Use explicit casts to avoid warnings when building with openssl 1.1Nick Mathewson
fixes bug 20551; bugfix on 0.2.1.1-alpha
2016-11-03Merge branch 'feature_15055_v2'Nick Mathewson
2016-11-03Audit use of tor_tls_cert_get_key().Nick Mathewson
This function is allowed to return NULL if the certified key isn't RSA. But in a couple of places we were treating this as a bug or internal error, and in one other place we weren't checking for it at all! Caught by Isis during code review for #15055. The serious bug was only on the 15055 branch, thank goodness.
2016-11-03Generate our x509 certificates using sha256, not sha1.Nick Mathewson
All supported Tors (0.2.4+) require versions of openssl that can handle this. Now that our link certificates are RSA2048, this might actually help vs fingerprinting a little.
2016-11-03For testing: add a tor_x509_cert_dup().Nick Mathewson
2016-11-03Increase TLS RSA link key length to 2048 bitsNick Mathewson
Oddly, nothing broke. Closes ticket 13752.
2016-11-03Make the current time an argument to x509 cert-checking functionsNick Mathewson
This makes the code a bit cleaner by having more of the functions be pure functions that don't depend on the current time.
2016-11-03New authentication types to use RFC5705.Nick Mathewson
See proposal 244. This feature lets us stop looking at the internals of SSL objects, *and* should let us port better to more SSL libraries, if they have RFC5705 support. Preparatory for #19156
2016-09-05Change servers to never pick 3DES.Nick Mathewson
Closes ticket 19998.
2016-08-31Do not call tor_tls_server_info_callback(NULL) from tests.Nick Mathewson
This isn't valid behavior, and it causes a crash when you run the unit tests at --debug. I've added an IF_BUG_ONCE() check for this case.
2016-08-19Merge branch 'maint-0.2.8'Nick Mathewson
2016-08-19Avoid confusing GCC 4.2.1 by saying "int foo()... inline int foo() {...}"Nick Mathewson
Fixes bug 19903; bugfix on 0.2.8.1-alpha.
2016-08-02Remove USE_BUFFEREVENTS code outside src/orNick Mathewson
2016-06-14Merge branch 'maint-0.2.8'Nick Mathewson
2016-06-14Bug 19406: OpenSSL removed SSL_R_RECORD_TOO_LARGE in 1.1.0.Yawning Angel
This is a logging onlu change, we were suppressing the severity down to INFO when it occured (treating it as "Mostly harmless"). Now it is no more.
2016-06-14Bug 19406: OpenSSL made RSA and DH opaque in 1.1.0.Yawning Angel
There's accessors to get at things, but it ends up being rather cumbersome. The only place where behavior should change is that the code will fail instead of attempting to generate a new DH key if our internal sanity check fails. Like the previous commit, this probably breaks snapshots prior to pre5.
2016-06-11Add -Wmissing-variable-declarations, with attendant fixesNick Mathewson
This is a big-ish patch, but it's very straightforward. Under this clang warning, we're not actually allowed to have a global variable without a previous extern declaration for it. The cases where we violated this rule fall into three roughly equal groups: * Stuff that should have been static. * Stuff that was global but where the extern was local to some other C file. * Stuff that was only global when built for the unit tests, that needed a conditional extern in the headers. The first two were IMO genuine problems; the last is a wart of how we build tests.
2016-06-11Use autoconf, not gcc version, to decide which warnings we haveNick Mathewson
This gives more accurate results under Clang, which can only help us detect more warnings in more places. Fixes bug 19216; bugfix on 0.2.0.1-alpha
2016-05-27Use ENABLE_GCC_WARNING and DISABLE_GCC_WARNING in tortls.cNick Mathewson
Previously we'd done this ad hoc.
2016-04-05OpenSSL 1.1.0-pre5-dev and later made BIO opaque.Yawning Angel
Detect newer versions and fix our TLS code to use the new API.
7apu2bq3rhoylwmucxizk54afw5jyda7pho4j5zdcqpwkufke7zdzwad.onion