Merge remote-tracking branch 'yawning/ticket16140'

This commit is contained in:
Nick Mathewson 2015-05-21 13:20:24 -04:00
commit 45a90573e6
5 changed files with 40 additions and 12 deletions

6
changes/ticket16140 Normal file
View File

@ -0,0 +1,6 @@
o Removed features:
- Tor no longer supports copies of OpenSSL that are missing support for
Elliptic Curve Cryptography. In particular support for at least one of
P256 or P224 is now required, with manual configuration needed if only
P224 is available.

View File

@ -49,6 +49,9 @@
#if OPENSSL_VERSION_NUMBER < OPENSSL_V_SERIES(1,0,0)
#error "We require OpenSSL >= 1.0.0"
#endif
#ifdef OPENSSL_NO_EC
#error "We require OpenSSL with ECC support"
#endif
#include <openssl/ssl.h>
#include <openssl/ssl3.h>
@ -475,7 +478,6 @@ tor_tls_init(void)
SSL_load_error_strings();
#if (SIZEOF_VOID_P >= 8 && \
!defined(OPENSSL_NO_EC) && \
OPENSSL_VERSION_NUMBER >= OPENSSL_V_SERIES(1,0,1))
long version = SSLeay();
@ -1327,7 +1329,6 @@ tor_tls_context_new(crypto_pk_t *identity, unsigned int key_lifetime,
SSL_CTX_set_tmp_dh(result->ctx, crypto_dh_get_dh_(dh));
crypto_dh_free(dh);
}
#if !defined(OPENSSL_NO_EC)
if (! is_client) {
int nid;
EC_KEY *ec_key;
@ -1343,9 +1344,6 @@ tor_tls_context_new(crypto_pk_t *identity, unsigned int key_lifetime,
SSL_CTX_set_tmp_ecdh(result->ctx, ec_key);
EC_KEY_free(ec_key);
}
#else
(void)flags;
#endif
SSL_CTX_set_verify(result->ctx, SSL_VERIFY_PEER,
always_accept_verify_cb);
/* let us realloc bufs that we're writing from */
@ -2933,3 +2931,29 @@ tor_tls_init_bufferevent(tor_tls_t *tls, struct bufferevent *bufev_in,
}
#endif
/** Check whether the ECC group requested is supported by the current OpenSSL
* library instance. Return 1 if the group is supported, and 0 if not.
*/
int
evaluate_ecgroup_for_tls(const char *ecgroup)
{
EC_KEY *ec_key;
int nid;
int ret;
if (!ecgroup)
nid = NID_tor_default_ecdhe_group;
else if (!strcasecmp(ecgroup, "P256"))
nid = NID_X9_62_prime256v1;
else if (!strcasecmp(ecgroup, "P224"))
nid = NID_secp224r1;
else
return 0;
ec_key = EC_KEY_new_by_curve_name(nid);
ret = (ec_key != NULL);
EC_KEY_free(ec_key);
return ret;
}

View File

@ -139,5 +139,7 @@ int tor_tls_cert_is_valid(int severity,
int check_rsa_1024);
const char *tor_tls_get_ciphersuite_name(tor_tls_t *tls);
int evaluate_ecgroup_for_tls(const char *ecgroup);
#endif

View File

@ -2806,6 +2806,9 @@ options_validate(or_options_t *old_options, or_options_t *options,
COMPLAIN("Unrecognized TLSECGroup: Falling back to the default.");
tor_free(options->TLSECGroup);
}
if (!evaluate_ecgroup_for_tls(options->TLSECGroup)) {
REJECT("Unsupported TLSECGroup.");
}
if (options->ExcludeNodes && options->StrictNodes) {
COMPLAIN("You have asked to exclude certain relays from all positions "

View File

@ -19,11 +19,9 @@ const char tor_git_revision[] = "";
#include "relay.h"
#include <openssl/opensslv.h>
#include <openssl/evp.h>
#ifndef OPENSSL_NO_EC
#include <openssl/ec.h>
#include <openssl/ecdh.h>
#include <openssl/obj_mac.h>
#endif
#include "config.h"
#include "crypto_curve25519.h"
@ -502,8 +500,6 @@ bench_dh(void)
" %f millisec each.\n", NANOCOUNT(start, end, iters)/1e6);
}
#if !defined(OPENSSL_NO_EC)
#define HAVE_EC_BENCHMARKS
static void
bench_ecdh_impl(int nid, const char *name)
{
@ -553,7 +549,6 @@ bench_ecdh_p224(void)
{
bench_ecdh_impl(NID_secp224r1, "P-224");
}
#endif
typedef void (*bench_fn)(void);
@ -576,10 +571,8 @@ static struct benchmark_t benchmarks[] = {
ENT(cell_aes),
ENT(cell_ops),
ENT(dh),
#ifdef HAVE_EC_BENCHMARKS
ENT(ecdh_p256),
ENT(ecdh_p224),
#endif
{NULL,NULL,0}
};