Commit 9d3dde37 authored by Michael Kaufmann's avatar Michael Kaufmann
Browse files

vtls: compare and clone ssl configs properly 

Compare these settings in Curl_ssl_config_matches():
- verifystatus (CURLOPT_SSL_VERIFYSTATUS)
- random_file (CURLOPT_RANDOM_FILE)
- egdsocket (CURLOPT_EGDSOCKET)

Also copy the setting "verifystatus" in Curl_clone_primary_ssl_config(),
and copy the setting "sessionid" unconditionally.

This means that reusing connections that are secured with a client
certificate is now possible, and the statement "TLS session resumption
is disabled when a client certificate is used" in the old advisory at
https://curl.haxx.se/docs/adv_20170419.html is obsolete.

Reviewed-by: Daniel Stenberg

Closes #1917
parent c4ebd8b4

lib/urldata.h

+1 −1
Original line number Original line Diff line number Diff line
@@ -210,13 +210,13 @@ struct ssl_primary_config { 
  bool verifypeer;       /* set TRUE if this is desired */

  bool verifypeer;       /* set TRUE if this is desired */

  bool verifyhost;       /* set TRUE if CN/SAN must match hostname */

  bool verifyhost;       /* set TRUE if CN/SAN must match hostname */

  bool verifystatus;     /* set TRUE if certificate status must be checked */

  bool verifystatus;     /* set TRUE if certificate status must be checked */

  bool sessionid;        /* cache session IDs or not */

  char *CApath;          /* certificate dir (doesn't work on windows) */

  char *CApath;          /* certificate dir (doesn't work on windows) */

  char *CAfile;          /* certificate to verify peer against */

  char *CAfile;          /* certificate to verify peer against */

  char *clientcert;

  char *clientcert;

  char *random_file;     /* path to file containing "random" data */

  char *random_file;     /* path to file containing "random" data */

  char *egdsocket;       /* path to file containing the EGD daemon socket */

  char *egdsocket;       /* path to file containing the EGD daemon socket */

  char *cipher_list;     /* list of ciphers to use */

  char *cipher_list;     /* list of ciphers to use */

  bool sessionid;        /* cache session IDs or not */

};

};





struct ssl_config_data {

struct ssl_config_data {

lib/vtls/vtls.c

+15 −12
Original line number Original line Diff line number Diff line
@@ -90,9 +90,12 @@ Curl_ssl_config_matches(struct ssl_primary_config* data, 
     (data->version_max == needle->version_max) &&

     (data->version_max == needle->version_max) &&

     (data->verifypeer == needle->verifypeer) &&

     (data->verifypeer == needle->verifypeer) &&

     (data->verifyhost == needle->verifyhost) &&

     (data->verifyhost == needle->verifyhost) &&

     (data->verifystatus == needle->verifystatus) &&

     Curl_safe_strcasecompare(data->CApath, needle->CApath) &&

     Curl_safe_strcasecompare(data->CApath, needle->CApath) &&

     Curl_safe_strcasecompare(data->CAfile, needle->CAfile) &&

     Curl_safe_strcasecompare(data->CAfile, needle->CAfile) &&

     Curl_safe_strcasecompare(data->clientcert, needle->clientcert) &&

     Curl_safe_strcasecompare(data->clientcert, needle->clientcert) &&

     Curl_safe_strcasecompare(data->random_file, needle->random_file) &&

     Curl_safe_strcasecompare(data->egdsocket, needle->egdsocket) &&

     Curl_safe_strcasecompare(data->cipher_list, needle->cipher_list))

     Curl_safe_strcasecompare(data->cipher_list, needle->cipher_list))

    return TRUE;

    return TRUE;
@@ -103,31 +106,31 @@ bool 
Curl_clone_primary_ssl_config(struct ssl_primary_config *source,

Curl_clone_primary_ssl_config(struct ssl_primary_config *source,

                              struct ssl_primary_config *dest)

                              struct ssl_primary_config *dest)

{

{

  dest->verifyhost = source->verifyhost;

  dest->verifypeer = source->verifypeer;

  dest->version = source->version;

  dest->version = source->version;

  dest->version_max = source->version_max;

  dest->version_max = source->version_max;

  dest->verifypeer = source->verifypeer;

  dest->verifyhost = source->verifyhost;

  dest->verifystatus = source->verifystatus;

  dest->sessionid = source->sessionid;





  CLONE_STRING(CAfile);

  CLONE_STRING(CApath);

  CLONE_STRING(CApath);

  CLONE_STRING(cipher_list);

  CLONE_STRING(CAfile);

  CLONE_STRING(egdsocket);

  CLONE_STRING(random_file);

  CLONE_STRING(clientcert);

  CLONE_STRING(clientcert);

  CLONE_STRING(random_file);

  CLONE_STRING(egdsocket);

  CLONE_STRING(cipher_list);





  /* Disable dest sessionid cache if a client cert is used, CVE-2016-5419. */

  dest->sessionid = (dest->clientcert ? false : source->sessionid);

  return TRUE;

  return TRUE;

}

}





void Curl_free_primary_ssl_config(struct ssl_primary_config* sslc)

void Curl_free_primary_ssl_config(struct ssl_primary_config* sslc)

{

{

  Curl_safefree(sslc->CAfile);

  Curl_safefree(sslc->CApath);

  Curl_safefree(sslc->CApath);

  Curl_safefree(sslc->cipher_list);

  Curl_safefree(sslc->CAfile);

  Curl_safefree(sslc->egdsocket);

  Curl_safefree(sslc->random_file);

  Curl_safefree(sslc->clientcert);

  Curl_safefree(sslc->clientcert);

  Curl_safefree(sslc->random_file);

  Curl_safefree(sslc->egdsocket);

  Curl_safefree(sslc->cipher_list);

}

}





#ifdef USE_SSL

#ifdef USE_SSL