Do not set the hostname TLS extension server-side; only client-side

This may fix bug 2204, and resolve the incompatibility with openssl
0.9.8p/1.0.0b.

diff --git a/changes/fix2204 b/changes/fix2204
new file mode 100644 (file)
index 0000000..fb2771a
--- /dev/null
+++ b/changes/fix2204
@@ -0,0 +1,7 @@
+  o Major bugfixes
+    - Do not set the tlsext_host_name extension on server SSL objects;
+      only on client SSL objects.  We set it to immitate a browser, not a
+      vhosting server. This resolves an incompatibility with openssl 0.9.8p
+      and openssl 1.0.0b.  Fixes bug 2204; bugfix on 0.2.1.1-alpha.
+
+

diff --git a/src/common/tortls.c b/src/common/tortls.c
index 25f21a98920bc6c6844f161762eeb2692409d4b2..2915f79195f2dbbdd6569e14cc95caecb1df05b9 100644 (file)
--- a/src/common/tortls.c
+++ b/src/common/tortls.c
@@ -898,7 +898,7 @@ tor_tls_new(int sock, int isServer)
 
 #ifdef SSL_set_tlsext_host_name
   /* Browsers use the TLS hostname extension, so we should too. */
-  {
+  if (!isServer) {
     char *fake_hostname = crypto_random_hostname(4,25, "www.",".com");
     SSL_set_tlsext_host_name(result->ssl, fake_hostname);
     tor_free(fake_hostname);