diff options
| author | Nick Mathewson <nickm@torproject.org> | 2018-09-07 09:15:56 -0400 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2018-09-07 09:15:56 -0400 |
| commit | 0330652346ed47863710454d3dccdc1b5109d53c (patch) | |
| tree | 061b293377c7ffa9cd23a578c1f2c86e7ac29bfb | |
| parent | 85cee6a749128b926cd727a5c0f2e516a260eb41 (diff) | |
| parent | 8849b2ca3c3943e7d2f109b8e56179be82092a6e (diff) | |
| download | tor-0330652346ed47863710454d3dccdc1b5109d53c.tar.gz tor-0330652346ed47863710454d3dccdc1b5109d53c.zip | |
Merge branch 'maint-0.3.4' into release-0.3.4
| -rw-r--r-- | changes/bug27344 | 4 | ||||
| -rw-r--r-- | configure.ac | 1 | ||||
| -rw-r--r-- | src/common/tortls.c | 7 |
3 files changed, 11 insertions, 1 deletions
diff --git a/changes/bug27344 b/changes/bug27344 new file mode 100644 index 0000000000..9f66855586 --- /dev/null +++ b/changes/bug27344 @@ -0,0 +1,4 @@ + o Minor features (compatibility): + - Tell OpenSSL to maintain backward compatibility with previous + RSA1024/DH1024 users in Tor. With OpenSSL 1.1.1-pre6, these ciphers + are disabled by default. Closes ticket 27344. diff --git a/configure.ac b/configure.ac index 6ef53eeb82..80c83d6cb7 100644 --- a/configure.ac +++ b/configure.ac @@ -941,6 +941,7 @@ AC_CHECK_FUNCS([ \ SSL_get_client_ciphers \ SSL_get_client_random \ SSL_CIPHER_find \ + SSL_CTX_set_security_level \ TLS_method ]) diff --git a/src/common/tortls.c b/src/common/tortls.c index 94db04b9d5..08aa35a480 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -1193,6 +1193,12 @@ tor_tls_context_new(crypto_pk_t *identity, unsigned int key_lifetime, if (!(result->ctx = SSL_CTX_new(SSLv23_method()))) goto error; #endif /* defined(HAVE_TLS_METHOD) */ + +#ifdef HAVE_SSL_CTX_SET_SECURITY_LEVEL + /* Level 1 re-enables RSA1024 and DH1024 for compatibility with old tors */ + SSL_CTX_set_security_level(result->ctx, 1); +#endif + SSL_CTX_set_options(result->ctx, SSL_OP_NO_SSLv2); SSL_CTX_set_options(result->ctx, SSL_OP_NO_SSLv3); @@ -2662,4 +2668,3 @@ evaluate_ecgroup_for_tls(const char *ecgroup) return ret; } - |