[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[GNUnet-SVN] [gnurl] 251/256: vtls: compare and clone ssl configs proper
From: |
gnunet |
Subject: |
[GNUnet-SVN] [gnurl] 251/256: vtls: compare and clone ssl configs properly |
Date: |
Fri, 06 Oct 2017 19:45:42 +0200 |
This is an automated email from the git hooks/post-receive script.
ng0 pushed a commit to branch master
in repository gnurl.
commit 9d3dde37a8ef5eb0fa03f411eb4296ffdbe6cf3d
Author: Michael Kaufmann <address@hidden>
AuthorDate: Sun Sep 24 14:08:29 2017 +0200
vtls: compare and clone ssl configs properly
Compare these settings in Curl_ssl_config_matches():
- verifystatus (CURLOPT_SSL_VERIFYSTATUS)
- random_file (CURLOPT_RANDOM_FILE)
- egdsocket (CURLOPT_EGDSOCKET)
Also copy the setting "verifystatus" in Curl_clone_primary_ssl_config(),
and copy the setting "sessionid" unconditionally.
This means that reusing connections that are secured with a client
certificate is now possible, and the statement "TLS session resumption
is disabled when a client certificate is used" in the old advisory at
https://curl.haxx.se/docs/adv_20170419.html is obsolete.
Reviewed-by: Daniel Stenberg
Closes #1917
---
lib/urldata.h | 2 +-
lib/vtls/vtls.c | 27 +++++++++++++++------------
2 files changed, 16 insertions(+), 13 deletions(-)
diff --git a/lib/urldata.h b/lib/urldata.h
index 5e5d98762..66e4596fd 100644
--- a/lib/urldata.h
+++ b/lib/urldata.h
@@ -210,13 +210,13 @@ struct ssl_primary_config {
bool verifypeer; /* set TRUE if this is desired */
bool verifyhost; /* set TRUE if CN/SAN must match hostname */
bool verifystatus; /* set TRUE if certificate status must be checked */
+ bool sessionid; /* cache session IDs or not */
char *CApath; /* certificate dir (doesn't work on windows) */
char *CAfile; /* certificate to verify peer against */
char *clientcert;
char *random_file; /* path to file containing "random" data */
char *egdsocket; /* path to file containing the EGD daemon socket */
char *cipher_list; /* list of ciphers to use */
- bool sessionid; /* cache session IDs or not */
};
struct ssl_config_data {
diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c
index 56eb7ebf1..bb8fda419 100644
--- a/lib/vtls/vtls.c
+++ b/lib/vtls/vtls.c
@@ -90,9 +90,12 @@ Curl_ssl_config_matches(struct ssl_primary_config* data,
(data->version_max == needle->version_max) &&
(data->verifypeer == needle->verifypeer) &&
(data->verifyhost == needle->verifyhost) &&
+ (data->verifystatus == needle->verifystatus) &&
Curl_safe_strcasecompare(data->CApath, needle->CApath) &&
Curl_safe_strcasecompare(data->CAfile, needle->CAfile) &&
Curl_safe_strcasecompare(data->clientcert, needle->clientcert) &&
+ Curl_safe_strcasecompare(data->random_file, needle->random_file) &&
+ Curl_safe_strcasecompare(data->egdsocket, needle->egdsocket) &&
Curl_safe_strcasecompare(data->cipher_list, needle->cipher_list))
return TRUE;
@@ -103,31 +106,31 @@ bool
Curl_clone_primary_ssl_config(struct ssl_primary_config *source,
struct ssl_primary_config *dest)
{
- dest->verifyhost = source->verifyhost;
- dest->verifypeer = source->verifypeer;
dest->version = source->version;
dest->version_max = source->version_max;
+ dest->verifypeer = source->verifypeer;
+ dest->verifyhost = source->verifyhost;
+ dest->verifystatus = source->verifystatus;
+ dest->sessionid = source->sessionid;
- CLONE_STRING(CAfile);
CLONE_STRING(CApath);
- CLONE_STRING(cipher_list);
- CLONE_STRING(egdsocket);
- CLONE_STRING(random_file);
+ CLONE_STRING(CAfile);
CLONE_STRING(clientcert);
+ CLONE_STRING(random_file);
+ CLONE_STRING(egdsocket);
+ CLONE_STRING(cipher_list);
- /* Disable dest sessionid cache if a client cert is used, CVE-2016-5419. */
- dest->sessionid = (dest->clientcert ? false : source->sessionid);
return TRUE;
}
void Curl_free_primary_ssl_config(struct ssl_primary_config* sslc)
{
- Curl_safefree(sslc->CAfile);
Curl_safefree(sslc->CApath);
- Curl_safefree(sslc->cipher_list);
- Curl_safefree(sslc->egdsocket);
- Curl_safefree(sslc->random_file);
+ Curl_safefree(sslc->CAfile);
Curl_safefree(sslc->clientcert);
+ Curl_safefree(sslc->random_file);
+ Curl_safefree(sslc->egdsocket);
+ Curl_safefree(sslc->cipher_list);
}
#ifdef USE_SSL
--
To stop receiving notification emails like this one, please contact
address@hidden
- [GNUnet-SVN] [gnurl] 149/256: docs/curl_mime_*.3: added examples, (continued)
- [GNUnet-SVN] [gnurl] 149/256: docs/curl_mime_*.3: added examples, gnunet, 2017/10/06
- [GNUnet-SVN] [gnurl] 93/256: configure: allow setting the default SSL backend, gnunet, 2017/10/06
- [GNUnet-SVN] [gnurl] 224/256: metalink: fix NSS issue in MultiSSL builds, gnunet, 2017/10/06
- [GNUnet-SVN] [gnurl] 198/256: non-ascii: use iconv() with 'char **' argument, gnunet, 2017/10/06
- [GNUnet-SVN] [gnurl] 136/256: RELEASE-NOTES: synced with 1ab9e9b50, gnunet, 2017/10/06
- [GNUnet-SVN] [gnurl] 189/256: code style: remove wrong uses of multiple spaces, gnunet, 2017/10/06
- [GNUnet-SVN] [gnurl] 166/256: travis: add c-ares enabled builds linux + osx, gnunet, 2017/10/06
- [GNUnet-SVN] [gnurl] 237/256: cookie: fix memory leak on oversized rejection, gnunet, 2017/10/06
- [GNUnet-SVN] [gnurl] 212/256: smtp: fix memory leak in OOM, gnunet, 2017/10/06
- [GNUnet-SVN] [gnurl] 254/256: THANKS: added new 7.56.0 contributors, gnunet, 2017/10/06
- [GNUnet-SVN] [gnurl] 251/256: vtls: compare and clone ssl configs properly,
gnunet <=
- [GNUnet-SVN] [gnurl] 203/256: socks: fix incorrect port number in SOCKS4 error message, gnunet, 2017/10/06
- [GNUnet-SVN] [gnurl] 138/256: curl.h: make the curl_strequal() protos use the same style, gnunet, 2017/10/06
- [GNUnet-SVN] [gnurl] 37/256: RELEASE-NOTES: synced with 8baead425, gnunet, 2017/10/06
- [GNUnet-SVN] [gnurl] 127/256: mime: use in curl cli tool instead of form API., gnunet, 2017/10/06
- [GNUnet-SVN] [gnurl] 158/256: mime: replace 'struct Curl_mimepart' by 'curl_mimepart' in encoder code., gnunet, 2017/10/06
- [GNUnet-SVN] [gnurl] 71/256: vtls: move the SUPPORT_HTTPS_PROXY flag into the Curl_ssl struct, gnunet, 2017/10/06
- [GNUnet-SVN] [gnurl] 75/256: axtls: use Curl_none_* versions of init() and cleanup(), gnunet, 2017/10/06
- [GNUnet-SVN] [gnurl] 131/256: mime: use size_t instead of ssize_t in public API interface., gnunet, 2017/10/06
- [GNUnet-SVN] [gnurl] 242/256: libcurl-tutorial: describe MIME API and deprecate form API., gnunet, 2017/10/06
- [GNUnet-SVN] [gnurl] 90/256: version: add the CURL_VERSION_MULTI_SSL feature flag, gnunet, 2017/10/06