|
@@ -1193,10 +1193,13 @@ tor_tls_context_new(crypto_pk_t *identity, unsigned int key_lifetime,
|
|
|
/* Disable TLS tickets if they're supported. We never want to use them;
|
|
|
* using them can make our perfect forward secrecy a little worse, *and*
|
|
|
* create an opportunity to fingerprint us (since it's unusual to use them
|
|
|
- * with TLS sessions turned off).
|
|
|
+ * with TLS sessions turned off). Clients need to advertise support for
|
|
|
+ * them, though to avoid a TLS distinguishability vector.
|
|
|
*/
|
|
|
#ifdef SSL_OP_NO_TICKET
|
|
|
- SSL_CTX_set_options(result->ctx, SSL_OP_NO_TICKET);
|
|
|
+ if (! is_client) {
|
|
|
+ SSL_CTX_set_options(result->ctx, SSL_OP_NO_TICKET);
|
|
|
+ }
|
|
|
#endif
|
|
|
|
|
|
if (
|