Skip to content
Snippets Groups Projects
  1. Jun 05, 2012
  2. Jun 04, 2012
  3. Jun 03, 2012
    • Nick Mathewson's avatar
      Work around a bug in OpenSSL 1.0.1's TLS 1.1 and TLS 1.2 support · 841a8d55
      Nick Mathewson authored
      It appears that when OpenSSL negotiates a 1.1 or 1.2 connection, and it
      decides to renegotiate, the client will send a record with version "1.0"
      rather than with the current TLS version.  This would cause the
      connection to fail whenever both sides had OpenSSL 1.0.1, and the v2 Tor
      handshake was in use.
      
      As a workaround, disable TLS 1.1 and TLS 1.2.  When a later version of
      OpenSSL is released, we can make this conditional on running a fixed
      version of OpenSSL.
      
      Alternatively, we could disable TLS 1.1 and TLS 1.2 only on the client
      side.  But doing it this way for now means that we not only fix TLS with
      patched clients; we also fix TLS when the server has this patch and the
      client does not.  That could be important to keep the network running
      well.
      
      Fixes bug 6033.
      841a8d55
  4. Jun 02, 2012
  5. May 31, 2012
Loading