randomize SSLKeyLifetime by default

resolves ticket 8443.

diff --git a/changes/ticket8443 b/changes/ticket8443
new file mode 100644 (file)
index 0000000..ca6fb2f
--- /dev/null
+++ b/changes/ticket8443
@@ -0,0 +1,4 @@
+  o Minor features:
+    - Randomize the lifetime of our SSL link certificate, so censors can't
+      use the static value for filtering Tor flows. Resolves ticket 8443;
+      related to ticket 4014 which was included in 0.2.2.33.

diff --git a/doc/tor.1.txt b/doc/tor.1.txt
index 75bca7937844b54a276559d4312ecd1260e6e697..505a0834b565d70c91bdc1799145b4bf498f0117 100644 (file)
--- a/doc/tor.1.txt
+++ b/doc/tor.1.txt
@@ -1500,8 +1500,13 @@ is non-zero):
 **ShutdownWaitLength** __NUM__::
     When we get a SIGINT and we're a server, we begin shutting down:
     we close listeners and start refusing new circuits. After **NUM**
-    seconds, we exit. If we get a second SIGINT, we exit immedi-
-    ately. (Default: 30 seconds)
+    seconds, we exit. If we get a second SIGINT, we exit immediately.
+    (Default: 30 seconds)
+
+**SSLKeyLifetime** __N__ **minutes**|**hours**|**days**|**weeks**::
+    When creating a link certificate for our outermost SSL handshake,
+    set its lifetime to this amount of time. If set to 0, Tor will choose
+    some reasonable random defaults. (Default: 0)
 
 **HeartbeatPeriod**  __N__ **minutes**|**hours**|**days**|**weeks**::
     Log a heartbeat message every **HeartbeatPeriod** seconds. This is

diff --git a/src/or/config.c b/src/or/config.c
index b7613bdf927dc24d29531d045181d1cbe9e6caa5..15138f9d7b5a6496d76d8d830fb3c693f0867955 100644 (file)
--- a/src/or/config.c
+++ b/src/or/config.c
@@ -380,7 +380,7 @@ static config_var_t option_vars_[] = {
   V(SocksPolicy,                 LINELIST, NULL),
   VPORT(SocksPort,                   LINELIST, NULL),
   V(SocksTimeout,                INTERVAL, "2 minutes"),
-  V(SSLKeyLifetime,              INTERVAL, "365 days"),
+  V(SSLKeyLifetime,              INTERVAL, "0"),
   OBSOLETE("StatusFetchPeriod"),
   V(StrictNodes,                 BOOL,     "0"),
   OBSOLETE("SysLog"),

diff --git a/src/or/or.h b/src/or/or.h
index a71468c1c6820447bab8d24da8c381bae6bd3018..c7d259853b570ce2293a9bb00f82909c84235487 100644 (file)
--- a/src/or/or.h
+++ b/src/or/or.h
@@ -4008,7 +4008,8 @@ typedef struct {
    */
   int DisableV2DirectoryInfo_;
 
-  /** What expiry time shall we place on our SSL certs? */
+  /** What expiry time shall we place on our SSL certs? "0" means we
+   * should guess a suitable value. */
   int SSLKeyLifetime;
 
 } or_options_t;

diff --git a/src/or/router.c b/src/or/router.c
index c9c35f6132e1dccedd730204c59bf10e356a7bce..211366351b8c112d32e4eb780e4988d966bcbe63 100644 (file)
--- a/src/or/router.c
+++ b/src/or/router.c
@@ -659,6 +659,10 @@ router_initialize_tls_context(void)
     else if (!strcasecmp(options->TLSECGroup, "P224"))
       flags |= TOR_TLS_CTX_USE_ECDHE_P224;
   }
+  if (!lifetime) { /* we should guess a good ssl cert lifetime */
+    /* choose between 1 and 365 days */
+    lifetime = 1*24*3600 + crypto_rand_int(364*24*3600);
+  }
 
   /* It's ok to pass lifetime in as an unsigned int, since
    * config_parse_interval() checked it. */