commit 340809dd224b244675496e301d3ba154a6fe68d0 Author: George Kadianakis desnacked@gmail.com Date: Wed Oct 26 13:16:14 2011 +0200
Get rid of tor_tls_block_renegotiation().
Since we check for naughty renegotiations using tor_tls_t.server_handshake_count we don't need that semi-broken function (at least till there is a way to disable rfc5746 renegotiations too). --- src/common/tortls.c | 10 ---------- src/common/tortls.h | 1 - src/or/connection_or.c | 5 ----- 3 files changed, 0 insertions(+), 16 deletions(-)
diff --git a/src/common/tortls.c b/src/common/tortls.c index 7269785..1150c42 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -1540,16 +1540,6 @@ tor_tls_unblock_renegotiation(tor_tls_t *tls) } }
-/** If this version of openssl supports it, turn off renegotiation on - * <b>tls</b>. (Our protocol never requires this for security, but it's nice - * to use belt-and-suspenders here.) - */ -void -tor_tls_block_renegotiation(tor_tls_t *tls) -{ - tls->ssl->s3->flags &= ~SSL3_FLAGS_ALLOW_UNSAFE_LEGACY_RENEGOTIATION; -} - void tor_tls_assert_renegotiation_unblocked(tor_tls_t *tls) { diff --git a/src/common/tortls.h b/src/common/tortls.h index 90e76e4..1219b80 100644 --- a/src/common/tortls.h +++ b/src/common/tortls.h @@ -75,7 +75,6 @@ int tor_tls_handshake(tor_tls_t *tls); int tor_tls_finish_handshake(tor_tls_t *tls); int tor_tls_renegotiate(tor_tls_t *tls); void tor_tls_unblock_renegotiation(tor_tls_t *tls); -void tor_tls_block_renegotiation(tor_tls_t *tls); void tor_tls_assert_renegotiation_unblocked(tor_tls_t *tls); int tor_tls_shutdown(tor_tls_t *tls); int tor_tls_get_pending_bytes(tor_tls_t *tls); diff --git a/src/or/connection_or.c b/src/or/connection_or.c index bcae075..6c56a61 100644 --- a/src/or/connection_or.c +++ b/src/or/connection_or.c @@ -1139,10 +1139,6 @@ connection_or_tls_renegotiated_cb(tor_tls_t *tls, void *_conn) or_connection_t *conn = _conn; (void)tls;
- /* Don't invoke this again. */ - tor_tls_set_renegotiate_callback(tls, NULL, NULL); - tor_tls_block_renegotiation(tls); - if (connection_tls_finish_handshake(conn) < 0) { /* XXXX_TLS double-check that it's ok to do this from inside read. */ /* XXXX_TLS double-check that this verifies certificates. */ @@ -1529,7 +1525,6 @@ connection_tls_finish_handshake(or_connection_t *conn) connection_or_init_conn_from_address(conn, &conn->_base.addr, conn->_base.port, digest_rcvd, 0); } - tor_tls_block_renegotiation(conn->tls); return connection_or_set_state_open(conn); } else { conn->_base.state = OR_CONN_STATE_OR_HANDSHAKING_V2;