mirrors/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2025-02-24 06:48:05 +01:00
Code Issues Projects Releases Wiki Activity

Revert "Get rid of tor_tls_block_renegotiation()."

Browse source 
This reverts commit 340809dd22.
This commit is contained in:
Nick Mathewson 2011-12-06 19:49:21 -05:00
parent fa74af0cfa
commit 021ff31ba6
3 changed files with 16 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
src/common/tortls.c
View file

@ -1572,6 +1572,16 @@ tor_tls_unblock_renegotiation(tor_tls_t *tls)
}
}
/** If this version of openssl supports it, turn off renegotiation on
* <b>tls</b>. (Our protocol never requires this for security, but it's nice
* to use belt-and-suspenders here.)
*/
void
tor_tls_block_renegotiation(tor_tls_t *tls)
{
tls->ssl->s3->flags &= ~SSL3_FLAGS_ALLOW_UNSAFE_LEGACY_RENEGOTIATION;
}
void
tor_tls_assert_renegotiation_unblocked(tor_tls_t *tls)
{

1
src/common/tortls.h
View file

@ -77,6 +77,7 @@ int tor_tls_handshake(tor_tls_t *tls);
int tor_tls_finish_handshake(tor_tls_t *tls);
int tor_tls_renegotiate(tor_tls_t *tls);
void tor_tls_unblock_renegotiation(tor_tls_t *tls);
void tor_tls_block_renegotiation(tor_tls_t *tls);
void tor_tls_assert_renegotiation_unblocked(tor_tls_t *tls);
int tor_tls_shutdown(tor_tls_t *tls);
int tor_tls_get_pending_bytes(tor_tls_t *tls);

5
src/or/connection_or.c
View file

@ -1149,6 +1149,10 @@ connection_or_tls_renegotiated_cb(tor_tls_t *tls, void *_conn)
or_connection_t *conn = _conn;
(void)tls;
/* Don't invoke this again. */
tor_tls_set_renegotiate_callback(tls, NULL, NULL);
tor_tls_block_renegotiation(tls);
if (connection_tls_finish_handshake(conn) < 0) {
/* XXXX_TLS double-check that it's ok to do this from inside read. */
/* XXXX_TLS double-check that this verifies certificates. */
@ -1537,6 +1541,7 @@ connection_tls_finish_handshake(or_connection_t *conn)
connection_or_init_conn_from_address(conn, &conn->_base.addr,
conn->_base.port, digest_rcvd, 0);
}
tor_tls_block_renegotiation(conn->tls);
return connection_or_set_state_open(conn);
} else {
conn->_base.state = OR_CONN_STATE_OR_HANDSHAKING_V2;