[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #25804 [Obfuscation/Snowflake]: Domain fronting to App Engine stopped working
#25804: Domain fronting to App Engine stopped working
-----------------------------------+------------------------
Reporter: dcf | Owner: (none)
Type: defect | Status: new
Priority: Medium | Milestone:
Component: Obfuscation/Snowflake | Version:
Severity: Normal | Resolution:
Keywords: moat | Actual Points:
Parent ID: | Points:
Reviewer: | Sponsor:
-----------------------------------+------------------------
Comment (by dcf):
Replying to [comment:7 yawning]:
> Replying to [comment:6 dcf]:
> > Here is a cheesy proof of concept. It's not suitable because it
disable certificate verification (`InsecureSkipVerify`). What's needed is
another parameter to verify the certificate ''as if'' we had accessed
www.google.com (or other specific domain).
>
> https://golang.org/pkg/crypto/tls/#Config (VerifyPeerCertificate)
> https://golang.org/pkg/crypto/x509/#Certificate.Verify
I posted some prototype code in comment:11:ticket:12208. I would
appreciate some review on it. It handles our use case of doing a TLS
handshake without SNI, but still verifying the certificate.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/25804#comment:29>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs