moparisthebest/curl
1
0
Fork 0
mirror of https://github.com/moparisthebest/curl synced 2025-02-28 09:21:50 -05:00
Code Issues Releases Wiki Activity

vtls: compare and clone ssl configs properly

Browse Source 
Compare these settings in Curl_ssl_config_matches():
- verifystatus (CURLOPT_SSL_VERIFYSTATUS)
- random_file (CURLOPT_RANDOM_FILE)
- egdsocket (CURLOPT_EGDSOCKET)

Also copy the setting "verifystatus" in Curl_clone_primary_ssl_config(),
and copy the setting "sessionid" unconditionally.

This means that reusing connections that are secured with a client
certificate is now possible, and the statement "TLS session resumption
is disabled when a client certificate is used" in the old advisory at
https://curl.haxx.se/docs/adv_20170419.html is obsolete.

Reviewed-by: Daniel Stenberg

Closes #1917
This commit is contained in:
Michael Kaufmann 2017-09-24 14:08:29 +02:00
parent c4ebd8b46d
commit 9d3dde37a8
2 changed files with 16 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
lib/urldata.h
View File

@ -210,13 +210,13 @@ struct ssl_primary_config {
bool verifypeer; /* set TRUE if this is desired */ bool verifypeer; /* set TRUE if this is desired */
bool verifyhost; /* set TRUE if CN/SAN must match hostname */ bool verifyhost; /* set TRUE if CN/SAN must match hostname */
bool verifystatus; /* set TRUE if certificate status must be checked */ bool verifystatus; /* set TRUE if certificate status must be checked */
bool sessionid; /* cache session IDs or not */
char *CApath; /* certificate dir (doesn't work on windows) */ char *CApath; /* certificate dir (doesn't work on windows) */
char *CAfile; /* certificate to verify peer against */ char *CAfile; /* certificate to verify peer against */
char *clientcert; char *clientcert;
char *random_file; /* path to file containing "random" data */ char *random_file; /* path to file containing "random" data */
char *egdsocket; /* path to file containing the EGD daemon socket */ char *egdsocket; /* path to file containing the EGD daemon socket */
char *cipher_list; /* list of ciphers to use */ char *cipher_list; /* list of ciphers to use */
bool sessionid; /* cache session IDs or not */
}; };
struct ssl_config_data { struct ssl_config_data {

27
lib/vtls/vtls.c
View File

@ -90,9 +90,12 @@ Curl_ssl_config_matches(struct ssl_primary_config* data,
(data->version_max == needle->version_max) && (data->version_max == needle->version_max) &&
(data->verifypeer == needle->verifypeer) && (data->verifypeer == needle->verifypeer) &&
(data->verifyhost == needle->verifyhost) && (data->verifyhost == needle->verifyhost) &&
(data->verifystatus == needle->verifystatus) &&
Curl_safe_strcasecompare(data->CApath, needle->CApath) && Curl_safe_strcasecompare(data->CApath, needle->CApath) &&
Curl_safe_strcasecompare(data->CAfile, needle->CAfile) && Curl_safe_strcasecompare(data->CAfile, needle->CAfile) &&
Curl_safe_strcasecompare(data->clientcert, needle->clientcert) && Curl_safe_strcasecompare(data->clientcert, needle->clientcert) &&
Curl_safe_strcasecompare(data->random_file, needle->random_file) &&
Curl_safe_strcasecompare(data->egdsocket, needle->egdsocket) &&
Curl_safe_strcasecompare(data->cipher_list, needle->cipher_list)) Curl_safe_strcasecompare(data->cipher_list, needle->cipher_list))
return TRUE; return TRUE;
@ -103,31 +106,31 @@ bool
Curl_clone_primary_ssl_config(struct ssl_primary_config *source, Curl_clone_primary_ssl_config(struct ssl_primary_config *source,
struct ssl_primary_config *dest) struct ssl_primary_config *dest)
{ {
dest->verifyhost = source->verifyhost;
dest->verifypeer = source->verifypeer;
dest->version = source->version; dest->version = source->version;
dest->version_max = source->version_max; dest->version_max = source->version_max;
dest->verifypeer = source->verifypeer;
dest->verifyhost = source->verifyhost;
dest->verifystatus = source->verifystatus;
dest->sessionid = source->sessionid;
CLONE_STRING(CAfile);
CLONE_STRING(CApath); CLONE_STRING(CApath);
CLONE_STRING(cipher_list); CLONE_STRING(CAfile);
CLONE_STRING(egdsocket);
CLONE_STRING(random_file);
CLONE_STRING(clientcert); CLONE_STRING(clientcert);
CLONE_STRING(random_file);
CLONE_STRING(egdsocket);
CLONE_STRING(cipher_list);
/* Disable dest sessionid cache if a client cert is used, CVE-2016-5419. */
dest->sessionid = (dest->clientcert ? false : source->sessionid);
return TRUE; return TRUE;
} }
void Curl_free_primary_ssl_config(struct ssl_primary_config* sslc) void Curl_free_primary_ssl_config(struct ssl_primary_config* sslc)
{ {
Curl_safefree(sslc->CAfile);
Curl_safefree(sslc->CApath); Curl_safefree(sslc->CApath);
Curl_safefree(sslc->cipher_list); Curl_safefree(sslc->CAfile);
Curl_safefree(sslc->egdsocket);
Curl_safefree(sslc->random_file);
Curl_safefree(sslc->clientcert); Curl_safefree(sslc->clientcert);
Curl_safefree(sslc->random_file);
Curl_safefree(sslc->egdsocket);
Curl_safefree(sslc->cipher_list);
} }
#ifdef USE_SSL #ifdef USE_SSL