nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-09-20 21:16:22 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/maint-0.2.2' into maint-0.2.3

Browse Source
This commit is contained in:
Nick Mathewson 2012-10-19 00:58:33 -04:00
commit a0e9dc9f55
2 changed files with 17 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
changes/bug7139 Normal file
View File

@ -0,0 +1,9 @@
o Major bugfixes (security):
- Disable TLS session tickets. OpenSSL's implementation were giving
our TLS session keys the lifetime of our TLS context objects, when
perfect forward secrecy would want us to discard anything that
could decrypt a link connection as soon as the link connection was
closed. Fixes bug 7139; bugfix on all versions of Tor linked
against OpenSSL 1.0.0 or later. Found by "nextgens".

8
src/common/tortls.c
View File

@ -1195,6 +1195,14 @@ tor_tls_context_new(crypto_pk_t *identity, unsigned int key_lifetime,
#ifdef SSL_OP_NO_TLSv1_1
SSL_CTX_set_options(result->ctx, SSL_OP_NO_TLSv1_1);
#endif
/* Disable TLS tickets if they're supported. We never want to use them;
* using them can make our perfect forward secrecy a little worse, *and*
* create an opportunity to fingerprint us (since it's unusual to use them
* with TLS sessions turned off).
*/
#ifdef SSL_OP_NO_TICKET
SSL_CTX_set_options(result->ctx, SSL_OP_NO_TICKET);
#endif
if (
#ifdef DISABLE_SSL3_HANDSHAKE