moparisthebest
/
curl
mirror of https://github.com/moparisthebest/curl
1
0
Fork 0
Code Issues Releases Wiki Activity

darwinssl: fix session ID keys to only reuse identical sessions 

...to avoid a session ID getting cached without certificate checking and
then after a subsequent _enabling_ of the check libcurl could still
re-use the session done without cert checks.

Bug: http://curl.haxx.se/docs/adv_20150108A.html
Reported-by: Marc Hesse
This commit is contained in:
Daniel Stenberg 2014-12-19 08:50:00 +01:00
parent 3df8e78860
commit 4ce22c607b
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
lib/vtls/curl_darwinssl.c
View File

@ -6,7 +6,7 @@
* \___|\___/|_| \_\_____|
*
* Copyright (C) 2012 - 2014, Nick Zitzmann, <nickzman@gmail.com>.
* Copyright (C) 2012 - 2014, Daniel Stenberg, <daniel@haxx.se>, et al.
* Copyright (C) 2012 - 2015, Daniel Stenberg, <daniel@haxx.se>, et al.
*
* This software is licensed as described in the file COPYING, which
* you should have received as part of this distribution. The terms
@ -1482,9 +1482,10 @@ static CURLcode darwinssl_connect_step1(struct connectdata *conn,
to starting the handshake. */
else {
CURLcode result;
ssl_sessionid = aprintf("curl:%s:%hu",
conn->host.name, conn->remote_port);
ssl_sessionid =
aprintf("%s:%d:%d:%s:%hu", data->set.str[STRING_SSL_CAFILE],
data->set.ssl.verifypeer, data->set.ssl.verifyhost,
conn->host.name, conn->remote_port);
ssl_sessionid_len = strlen(ssl_sessionid);
err = SSLSetPeerID(connssl->ssl_ctx, ssl_sessionid, ssl_sessionid_len);