nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-12-01 08:03:31 +01:00
Code Issues Packages Projects Releases Wiki Activity

Revert "Try using SSL_get_ciphers in place of session->ciphers"

Browse Source 
This reverts commit 67964cfa78.

It was the cause of #16153, and was not in any released Tor.  We need
a better solution for getting session->ciphers.
This commit is contained in:
Nick Mathewson 2015-05-22 10:22:11 -04:00
parent f0a0568e7f
commit 44259b8942
1 changed files with 5 additions and 31 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
src/common/tortls.c
View File

@ -1682,40 +1682,14 @@ tor_tls_classify_client_ciphers(const SSL *ssl,
* handshake. */ * handshake. */
static int static int
tor_tls_client_is_using_v2_ciphers(const SSL *ssl) tor_tls_client_is_using_v2_ciphers(const SSL *ssl)
{
STACK_OF(SSL_CIPHER) *ciphers = SSL_get_ciphers(ssl);
#if OPENSSL_VERSION_NUMBER < OPENSSL_V_SERIES(1,1,0)
{ {
SSL_SESSION *session; SSL_SESSION *session;
STACK_OF(SSL_CIPHER) *c1;
int i;
if (!(session = SSL_get_session((SSL *)ssl))) { if (!(session = SSL_get_session((SSL *)ssl))) {
log_info(LD_NET, "No session on TLS?"); log_info(LD_NET, "No session on TLS?");
return CIPHERS_ERR; return CIPHERS_ERR;
} }
c1 = session->ciphers;
if (sk_SSL_CIPHER_num(c1) != sk_SSL_CIPHER_num(ciphers)) { return tor_tls_classify_client_ciphers(ssl, session->ciphers) >= CIPHERS_V2;
log_warn(LD_BUG, "Whoops. session->ciphers doesn't "
"match SSL_get_ciphers()");
return 0;
}
for (i = 0; i < sk_SSL_CIPHER_num(c1); ++i) {
SSL_CIPHER *a = sk_SSL_CIPHER_value(ciphers, i);
SSL_CIPHER *b = sk_SSL_CIPHER_value(c1, i);
unsigned long a_id = SSL_CIPHER_get_id(a);
unsigned long b_id = SSL_CIPHER_get_id(b);
if (a_id != b_id) {
log_warn(LD_BUG, "Cipher mismatch between session->ciphers and "
"SSL_get_ciphers() at %d: %lx vs %lx", i,
a_id, b_id);
}
}
}
#endif
return tor_tls_classify_client_ciphers(ssl, ciphers) >= CIPHERS_V2;
} }
/** Invoked when we're accepting a connection on <b>ssl</b>, and the connection /** Invoked when we're accepting a connection on <b>ssl</b>, and the connection