torproject/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-12-06 19:41:15 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge branch 'bug24978_029_enable' into maint-0.2.9

Browse Source
This commit is contained in:
Nick Mathewson
2018-02-10 16:08:58 -05:00
parent 0ddc2dc531 0dbe3ddc33
commit 320dac4602
3 changed files with 52 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/common/ciphers.inc
+20 -1
View File
@@ -2,8 +2,27 @@
* advertise. Before including it, you should define the CIPHER and XCIPHER
* macros.
*
* This file was automatically generated by get_mozilla_ciphers.py.
* This file was automatically generated by get_mozilla_ciphers.py;
* TLSv1.3 ciphers were added manually.
*/
/* Here are the TLS1.3 ciphers. Note that we don't have XCIPHER instances
* here, since we don't want to ever fake them.
*/
#ifdef TLS1_3_TXT_AES_128_GCM_SHA256
CIPHER(0x1301, TLS1_3_TXT_AES_128_GCM_SHA256)
#endif
#ifdef TLS1_3_TXT_AES_256_GCM_SHA384
CIPHER(0x1302, TLS1_3_TXT_AES_256_GCM_SHA384)
#endif
#ifdef TLS1_3_TXT_CHACHA20_POLY1305_SHA256
CIPHER(0x1303, TLS1_3_TXT_CHACHA20_POLY1305_SHA256)
#endif
#ifdef TLS1_3_TXT_AES_128_CCM_SHA256
CIPHER(0x1304, TLS1_3_TXT_AES_128_CCM_SHA256)
#endif
/* Here's the machine-generated list. */
#ifdef TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
CIPHER(0xc02b, TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256)
#else
src/common/tortls.c
+25 -3
View File
@@ -550,13 +550,35 @@ MOCK_IMPL(STATIC X509 *,
/** List of ciphers that servers should select from when the client might be
* claiming extra unsupported ciphers in order to avoid fingerprinting. */
#define SERVER_CIPHER_LIST \
(TLS1_TXT_DHE_RSA_WITH_AES_256_SHA ":" \
TLS1_TXT_DHE_RSA_WITH_AES_128_SHA)
static const char SERVER_CIPHER_LIST[] =
#ifdef TLS1_3_TXT_AES_128_GCM_SHA256
/* This one can never actually get selected, since if the client lists it,
* we will assume that the client is honest, and not use this list.
* Nonetheless we list it if it's available, so that the server doesn't
* conclude that it has no valid ciphers if it's running with TLS1.3.
*/
TLS1_3_TXT_AES_128_GCM_SHA256 ":"
#endif
TLS1_TXT_DHE_RSA_WITH_AES_256_SHA ":"
TLS1_TXT_DHE_RSA_WITH_AES_128_SHA;
/** List of ciphers that servers should select from when we actually have
* our choice of what cipher to use. */
static const char UNRESTRICTED_SERVER_CIPHER_LIST[] =
/* Here are the TLS 1.3 ciphers we like, in the order we prefer. */
#ifdef TLS1_3_TXT_AES_256_GCM_SHA384
TLS1_3_TXT_AES_256_GCM_SHA384 ":"
#endif
#ifdef TLS1_3_TXT_CHACHA20_POLY1305_SHA256
TLS1_3_TXT_CHACHA20_POLY1305_SHA256 ":"
#endif
#ifdef TLS1_3_TXT_AES_128_GCM_SHA256
TLS1_3_TXT_AES_128_GCM_SHA256 ":"
#endif
#ifdef TLS1_3_TXT_AES_128_CCM_SHA256
TLS1_3_TXT_AES_128_CCM_SHA256 ":"
#endif
/* This list is autogenerated with the gen_server_ciphers.py script;
* don't hand-edit it. */
#ifdef TLS1_TXT_ECDHE_RSA_WITH_AES_256_GCM_SHA384