diff options
| author | Roger Dingledine <arma@torproject.org> | 2013-03-09 17:16:11 -0500 |
|---|---|---|
| committer | Roger Dingledine <arma@torproject.org> | 2013-03-10 23:38:18 -0400 |
| commit | edd6f02273c58bfe39a978dd5c7b8765aae0b886 (patch) | |
| tree | 967a5600dee954b899cb7e34da8467f1a0e425c3 /src/or/router.c | |
| parent | 599aeef9bc9e707ec7146da79b2018bf2f2924b3 (diff) | |
| download | tor-edd6f02273c58bfe39a978dd5c7b8765aae0b886.tar.gz tor-edd6f02273c58bfe39a978dd5c7b8765aae0b886.zip | |
randomize SSLKeyLifetime by default
resolves ticket 8443.
Diffstat (limited to 'src/or/router.c')
| -rw-r--r-- | src/or/router.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/src/or/router.c b/src/or/router.c index c9c35f6132..211366351b 100644 --- a/src/or/router.c +++ b/src/or/router.c @@ -659,6 +659,10 @@ router_initialize_tls_context(void) else if (!strcasecmp(options->TLSECGroup, "P224")) flags |= TOR_TLS_CTX_USE_ECDHE_P224; } + if (!lifetime) { /* we should guess a good ssl cert lifetime */ + /* choose between 1 and 365 days */ + lifetime = 1*24*3600 + crypto_rand_int(364*24*3600); + } /* It's ok to pass lifetime in as an unsigned int, since * config_parse_interval() checked it. */ |