I don't think any other entries use "Default" lke this, and the repetition
seems pointless. The historical context was broken off to keep the "main" part
short and tidy.
ValdikSS [Thu, 26 Jun 2025 14:24:28 +0000 (10:24 -0400)]
tls: Set TLSv1.3 ciphers to preserve ciphersuites order
This commit fixes two issues:
1. ciphers.inc has TLSv1.3 ciphers prefixed with "TXT", while current version
has "RFC". TLS1_3_RFC_AES_128_GCM_SHA256 should be instead of
TLS1_3_TXT_AES_128_GCM_SHA256, in both define and CIPHER() macro.
2. Tor calls only SSL_set_cipher_list() in tlstls_openssl.c, this sets only
TLSv1.2 ciphers, while TLSv1.3 ciphers stay in default state. TLSv1.3
ciphersuites are set with SSL_set_ciphersuites(), but the list require to
contain only TLSv1.3 suites (no v1.2).
Contrary to SSL_set_cipher_list(), TLSv1.3 SSL_set_ciphersuites() does NOT
accept finalizing :, so it should be stripped out.
Signed-off-by: David Goulet <dgoulet@torproject.org>
Waldemar Zimpel [Mon, 9 Jun 2025 12:07:33 +0000 (14:07 +0200)]
Logging / Channel padding delay
Reduce the amount of messages being logged related to
channel padding delay when log level is "notice".
Log the channel padding delay as "info" as soon as the
delay occurs. Log "notice" on each heartbeat only
containing the average channel padding delay and the
amount of delays (that exceeded the allowed time window)
occurring between heartbeats or, if first heartbeat
since startup, between startup and heartbeat.
Nick Mathewson [Mon, 19 May 2025 01:11:00 +0000 (21:11 -0400)]
Fix a new GCC warning about strings.
When we say something like
```
const char foo[3] = "foo";
```
GCC now complains, because there is no space for the terminating NUL.
But we use this construction in a lot of places in our tests to
initialize test digests, keys, and so on. So to resolve the issue,
we have to mark these strings with a new attribute.
orbea [Thu, 31 Aug 2023 21:35:52 +0000 (14:35 -0700)]
crypt_openssl_mgt: define DISABLE_ENGINES after OPENSSL_NO_ENGINE
With LibreSSL-3.8.1 these engines are no long available causing a build
failure, but LibreSSL correctly defines OPENSSL_NO_ENGINE as part of its
opensslfeatures.h. However Tor includes crypto_openssl_mgt.h before any
of the openssl includes which would define OPENSSL_NO_ENGINE and then
fails to define DISABLE_ENGINES.
As the define is used in only a single .c file it is best to move it
there.
David Goulet [Thu, 27 Mar 2025 12:49:40 +0000 (08:49 -0400)]
conflux: Avoid non fatal assert in CIRCUIT_IS_CONFLUX()
In the circuit_about_to_free(), we clear the circ->conflux object and then we
end up trying to emit an event on the control port which calls
CIRCUIT_IS_CONFLUX() and non fatal assert on the false branch.
Fixes #41037
Signed-off-by: David Goulet <dgoulet@torproject.org>
Jim Newsome [Wed, 30 Oct 2024 15:34:58 +0000 (10:34 -0500)]
CI: use a fixed version of chutney
While chutney currently runs tor's chutney test in its own CI,
it's difficult to guarantee the two won't accidentally diverge.
Probably best to use a fixed version here so that we can control
chutney version bumps and avoid surprise breakage in tor's CI.
This will also free us to intentionally make breaking changes in
chutney (though I don't have any immediate plans for any).
David Goulet [Tue, 28 Jan 2025 18:27:14 +0000 (13:27 -0500)]
hashx: Move Windows function within another ifdef
Function only used within the hugepage ifdef for Windows so move it there so we
avoid a unused function warning on our Windows CI:
src/ext/equix/hashx/src/virtual_memory.c:30:13: error: 'set_privilege' defined but not used [-Werror=unused-function]
30 | static bool set_privilege(const char* pszPrivilege, BOOL bEnable) {
| ^~~~~~~~~~~~~
Signed-off-by: David Goulet <dgoulet@torproject.org>
David Goulet [Wed, 18 Dec 2024 16:04:00 +0000 (11:04 -0500)]
hs: Use downloaded counter for HSDir OOM cache cleanup
The OOM cache cleanup is now done by looking at the downloaded counter. The
cleanup process start at 0 and increment it to the next lowest value until
enough bytes have been removed.
This process could be expensive for large amount of descriptors in the cache
but since it is very expensive to increment counters, most cleanup should
happen within a tight range of downloaded counter target.
Fixes #40996
Signed-off-by: David Goulet <dgoulet@torproject.org>
David Goulet [Wed, 18 Dec 2024 15:24:28 +0000 (10:24 -0500)]
hs: Add downloaded counter to an HSDir cache entry
This adds a counter for the number of times a descriptor is downloaded from an
HSDir. Future commit will change the OOM subsystem to clean that cache based on
the lowest downloaded counts instead of time in cache.
In order to raise the bar even more for an attacker, the downloaded counter is
only marked when the directory request stream is closed. To pull this off, the
HS identifier on the directory connection is populated with the blinded key
requested (only on success). Finally, when the connection closes, we can then
lookup the cache entry with it and increment the counter.
Part of #40996
Signed-off-by: David Goulet <dgoulet@torproject.org>
Jim Newsome [Fri, 15 Nov 2024 00:38:22 +0000 (18:38 -0600)]
test-network: include IPv6 tests unconditionally
Previously we would incorrectly detect that ipv6 isn't supported if the
ping binary isn't present (as it may not be in a relatively stripped
down container image), or if ICMP packets aren't permitted (as they
often aren't in containers).
We don't really have a need to run these network tests on non-IPv6
systems, so it makes more sense to just run them unconditionally.
projects / thirdparty / tor.git / log
