[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Tor fails to build connections after FreeBSD security update
- To: tor-relays@xxxxxxxxxxxxxx
- Subject: Tor fails to build connections after FreeBSD security update
- From: Hans Schnehl <torvallenator@xxxxxxxxx>
- Date: Sat, 5 Dec 2009 15:54:19 +0100
- Delivered-to: archiver@xxxxxxxx
- Delivered-to: tor-relays-outgoing@xxxxxxxx
- Delivered-to: tor-relays@xxxxxxxx
- Delivery-date: Sat, 05 Dec 2009 09:55:46 -0500
- Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:date:from:to:subject :message-id:mime-version:content-type:content-disposition:user-agent; bh=t9zw/w4HgC5FGHmLmKeAw1p6pozFtOrIUSFURbjKkK8=; b=KRtJ9MtKjXUfkrvgrVy1dfEnBmBSq7tYDY9SMhbplLjb8ARVmfzErtOcbnarMe+qI9 zn8KHow2ITiIKtcN2ab+nlP5/bdPdaUBgwjY9Y1sAmR+s7PRXSorgcvzio6n0QbVBwPQ 4jEs6NaXzDc7pJANCKgsxHmiYO1v/xsK3jqnA=
- Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=date:from:to:subject:message-id:mime-version:content-type :content-disposition:user-agent; b=VvJrnnqhyNplqBOZppDh+OnkeJVFsvQKkLyoDs4MOSFmNjbUKuCk9aqbpino6gWb9X O7uQKUmZXaoa7SeSazK1urf7ODQf98s+n2XMdWZgWkr8hClmvzFqt/I5P+EiVKLTZHAz ZpziNouJYaJTlQp+aVQmzpKxUuU1Wy0EUNZj4=
- Reply-to: tor-relays@xxxxxxxxxxxxxx
- Sender: owner-tor-relays@xxxxxxxxxxxxxx
- User-agent: Mutt/1.5.19 (2009-01-05)
Hi,
Due to several security advisories ther have been a few patches advised to
be applied on FreeBSD systems.
These are
FreeBSD-SA-09:15.ssl ,
FreeBSD-SA-09:16.rtld,
FreeBSD-SA-09:17.freebsd-update
FreeBSD-SA-09:15.ssl [REVISED]
FreeBSD-SA-09:15.ssl is to be found at
http://lists.freebsd.org/pipermail/freebsd-security-notifications/2009-December/000136.html
and notes:
[snip]]
NOTE WELL: This update causes OpenSSL to reject any attempt to renegotiate
SSL / TLS session parameters. As a result, connections in which the other
party attempts to renegotiate session parameters will break. In practice,
however, session renegotiation is a rarely-used feature, so disabling this
functionality is unlikely to cause problems for most systems.
[snip]
Well, so shall it be.
I rebuild world to 7.2-STABLE #0 r200100: Fri Dec 4 16:29, but one may just
as well apply patches, see above.
After that Tor, runnig perfectly before the update, fails to build connections.
There are plenties of info level messages about failed TLS renegotiation, which
is just about what the above messages says (surprise!)
Tor is:
Tor version 0.2.2.6-alpha (git-1ee580407ccb9130), which is the default
tor-devel version available from the fbsd ports ,
the box is running 7.2-STABLE on i386.
Tor itself and libevent have been rebuild after the build.
The default Openssl version coming with the 7,2 basesystem is OpenSSL 0.9.8e,
now patched Tor fails to bootstrap ( messages like '...stuck at
85%').
I made Tor use the ports version, openssl-0.9.8l, and with that
Tor after all is able to build circuits, but only after a unusual
long time and complaining.
Tor though still fails to accept the StrictEntryNodes option, it can't connect to
the nodes listed under EntryNodes and therefore no circuits are build with
this option set. (The nodes are up, but handled as being down)
THis happened on a box running Tor as a client. Don't really want that
to happen on a busy relay.
Anyone else seeing this?
Solutions apart from using openssl-0.9.8l ?
What did I possibly miss ?
Regards
Hans