Github/emacs
2
0
Fork 1
mirror of git://git.sv.gnu.org/emacs.git synced 2026-02-16 17:24:23 +00:00
Code Issues Projects Releases Packages Wiki Activity

Don't check for :safe-renegotiation with TLS1.3

Browse source 
* lisp/net/nsm.el (nsm-protocol-check--renegotiation-info-ext): Don't
check when using TLS1.3, renegotiation has been removed from TLS.
Reported in
<https://lists.gnu.org/archive/html/help-gnu-emacs/2019-09/msg00005.html>
This commit is contained in:
Robert Pluim 2019-09-02 14:55:00 +02:00
parent a843266113
commit 95becaaf3b
1 changed files with 7 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
lisp/net/nsm.el
View file

@ -665,17 +665,19 @@ the MD5 Message-Digest and the HMAC-MD5 Algorithms\",
If this TLS extension is not used, the connection established is
vulnerable to an attack in which an impersonator can extract
sensitive information such as HTTP session ID cookies or login
passwords.
passwords. Renegotiation was removed in TLS1.3, so this is only
checked for earlier protocol versions.
Reference:
E. Rescorla, M. Ray, S. Dispensa, N. Oskov (Feb 2010). \"Transport
Layer Security (TLS) Renegotiation Indication Extension\",
`https://tools.ietf.org/html/rfc5746'"
(let ((unsafe-renegotiation (not (plist-get status :safe-renegotiation))))
(and unsafe-renegotiation
(format-message
"safe renegotiation is not supported, connection not protected from impersonators"))))
(when (plist-member status :safe-renegotiation)
(let ((unsafe-renegotiation (not (plist-get status :safe-renegotiation))))
(and unsafe-renegotiation
(format-message
"safe renegotiation is not supported, connection not protected from impersonators")))))
;; Compression checks