From 068185eca2e2f8b51069f81b00c24c56da05b859 Mon Sep 17 00:00:00 2001 From: Robert Ransom Date: Fri, 1 Oct 2010 11:53:11 -0700 Subject: [PATCH 1/3] Fix several comments in tortls.c --- src/common/tortls.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/src/common/tortls.c b/src/common/tortls.c index 7dfdca6af9..25d44cc970 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -86,7 +86,9 @@ static int use_unsafe_renegotiation_op = 0; * SSL3_FLAGS_ALLOW_UNSAFE_LEGACY_RENEGOTIATION? */ static int use_unsafe_renegotiation_flag = 0; -/** Structure holding the TLS state for a single connection. */ +/** Holds a SSL_CTX object and related state used to configure TLS + * connections. + */ typedef struct tor_tls_context_t { int refcnt; SSL_CTX *ctx; @@ -372,7 +374,7 @@ tor_tls_init(void) version = SSLeay(); - /* OpenSSL 0.9.8l introduced SSL3_FLAGS_ALLOW_UNSAGE_LEGACY_RENEGOTIATION + /* OpenSSL 0.9.8l introduced SSL3_FLAGS_ALLOW_UNSAFE_LEGACY_RENEGOTIATION * here, but without thinking too hard about it: it turns out that the * flag in question needed to be set at the last minute, and that it * conflicted with an existing flag number that had already been added @@ -555,9 +557,9 @@ tor_tls_create_certificate(crypto_pk_env_t *rsa, (TLS1_TXT_DHE_RSA_WITH_AES_256_SHA ":" \ TLS1_TXT_DHE_RSA_WITH_AES_128_SHA ":" \ SSL3_TXT_EDH_RSA_DES_192_CBC3_SHA) -/* Note: for setting up your own private testing network with link crypto - * disabled, set the cipher lists to your cipher list to - * SSL3_TXT_RSA_NULL_SHA. If you do this, you won't be able to communicate +/* Note: to set up your own private testing network with link crypto + * disabled, set your Tors' cipher list to + * (SSL3_TXT_RSA_NULL_SHA). If you do this, you won't be able to communicate * with any of the "real" Tors, though. */ #ifdef V2_HANDSHAKE_CLIENT @@ -618,7 +620,7 @@ tor_tls_context_incref(tor_tls_context_t *ctx) /** Create a new TLS context for use with Tor TLS handshakes. * identity should be set to the identity key used to sign the - * certificate, and nickname set to the nickname to use. + * certificate. * * You can call this function multiple times. Each time you call it, * it generates new certificates; all new connections will use From c70d9d77ab304dd490be7bb3fefd0eeb89d37373 Mon Sep 17 00:00:00 2001 From: Robert Ransom Date: Fri, 1 Oct 2010 17:48:07 -0700 Subject: [PATCH 2/3] Correct a couple of log messages in tortls.c --- changes/bug1994 | 6 ++++++ src/common/tortls.c | 4 ++-- 2 files changed, 8 insertions(+), 2 deletions(-) create mode 100644 changes/bug1994 diff --git a/changes/bug1994 b/changes/bug1994 new file mode 100644 index 0000000000..07095aa7c9 --- /dev/null +++ b/changes/bug1994 @@ -0,0 +1,6 @@ + o Minor bugfixes: + - Correctly describe errors that occur when generating a TLS object + when logging them. Previously we would attribtue them to a failure + while generating a TLS context. Bugfix by Robert Ransom. Bugfix + on 0.1.0.4-rc. + diff --git a/src/common/tortls.c b/src/common/tortls.c index 25d44cc970..0304045e63 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -930,7 +930,7 @@ tor_tls_new(int sock, int isServer) tor_assert(global_tls_context); /* make sure somebody made it first */ if (!(result->ssl = SSL_new(global_tls_context->ctx))) { - tls_log_errors(NULL, LOG_WARN, LD_NET, "generating TLS context"); + tls_log_errors(NULL, LOG_WARN, LD_NET, "creating SSL object"); tor_free(result); return NULL; } @@ -987,7 +987,7 @@ tor_tls_new(int sock, int isServer) #endif /* Not expected to get called. */ - tls_log_errors(NULL, LOG_WARN, LD_NET, "generating TLS context"); + tls_log_errors(NULL, LOG_WARN, LD_NET, "creating tor_tls_t object"); return result; } From 1b8c8059c72940e47afa787fe50adbcfeb192895 Mon Sep 17 00:00:00 2001 From: Robert Ransom Date: Sat, 2 Oct 2010 00:31:45 -0700 Subject: [PATCH 3/3] Correct a bogus comment. Whether or not OpenSSL reference-counts SSL_CTX objects is irrelevant; what matters is that Tor reference-counts its wrapper objects for SSL_CTXs. --- src/common/tortls.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/common/tortls.c b/src/common/tortls.c index 0304045e63..99f3f4abbc 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -723,8 +723,8 @@ tor_tls_context_new(crypto_pk_env_t *identity, unsigned int key_lifetime) SSL_CTX_set_mode(result->ctx, SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER); /* Free the old context if one exists. */ if (global_tls_context) { - /* This is safe even if there are open connections: OpenSSL does - * reference counting with SSL and SSL_CTX objects. */ + /* This is safe even if there are open connections: we reference- + * count tor_tls_context_t objects. */ tor_tls_context_decref(global_tls_context); } global_tls_context = result;