diff options
| author | Nick Mathewson <nickm@torproject.org> | 2010-04-13 14:58:30 -0400 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2010-04-13 15:05:03 -0400 |
| commit | 6ad09cc6afa4d620978b6b18f7f134d15903dcc1 (patch) | |
| tree | 7845e5b13859e18996ff032084ca56c773372d31 /changes/use_ssl_option_everywhere | |
| parent | 5e679acc72a2648c38a3ee3a2b05cd5b75906568 (diff) | |
| download | tor-6ad09cc6afa4d620978b6b18f7f134d15903dcc1.tar tor-6ad09cc6afa4d620978b6b18f7f134d15903dcc1.tar.gz | |
Fix renegotiation on OpenSSL versions that backport RFC5746.
Our code assumed that any version of OpenSSL before 0.9.8l could not
possibly require SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION. This is
so... except that many vendors have backported the flag from later
versions of openssl when they backported the RFC5476 renegotiation
feature.
The new behavior is particularly annoying to detect. Previously,
leaving SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION unset meant that
clients would fail to renegotiate. People noticed that one fast!
Now, OpenSSL's RFC5476 support means that clients will happily talk to
any servers there are, but servers won't accept renegotiation requests
from unpatched clients unless SSL_OP_ALLOW_etc is set. More fun:
servers send back a "no renegotiation for you!" error, which unpatched
clients respond to by stalling, and generally producing no useful
error message.
This might not be _the_ cause of bug 1346, but it is quite likely _a_
cause for bug 1346.
Diffstat (limited to 'changes/use_ssl_option_everywhere')
| -rw-r--r-- | changes/use_ssl_option_everywhere | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/changes/use_ssl_option_everywhere b/changes/use_ssl_option_everywhere new file mode 100644 index 000000000..02adb3c8b --- /dev/null +++ b/changes/use_ssl_option_everywhere @@ -0,0 +1,5 @@ + o Major bugfixes: + - Fix SSL renegotiation behavior on OpenSSL versions that claim to + be earlier than 0.9.8m, but which have in reality backported huge + swaths of 0.9.8m or 0.9.8n renegotiation behavior. Possibly fix + for some cases of bug 1346. |