Commit 673d7ac1 authored by Lutz Jänicke's avatar Lutz Jänicke
Browse files

Store verify_result with sessions to avoid potential security hole. 

For the server side this was already done one year ago :-(
parent 666d4375

CHANGES

+6 −0
Original line number Diff line number Diff line
@@ -4,6 +4,12 @@ 


 Changes between 0.9.6 and 0.9.6a  [xx XXX 2000]



  *) Store verify_result within SSL_SESSION also for client side to

     avoid potential security hole. (Re-used sessions on the client side

     always resulted in verify_result==X509_V_OK, not using the original

     result of the server certificate verification.)

     [Lutz Jaenicke]



  *) Disable ssl2_peek and ssl3_peek (i.e., both implementations

     of SSL_peek) because they both are completely broken.

     They will be fixed RSN by adding an additional 'peek' parameter

ssl/s2_clnt.c

+1 −0
Original line number Diff line number Diff line
@@ -921,6 +921,7 @@ int ssl2_set_certificate(SSL *s, int type, int len, unsigned char *data) 
		goto err;

		}

	ERR_clear_error(); /* but we keep s->verify_result */

	s->session->verify_result = s->verify_result;



	/* server's cert for this session */

	sc=ssl_sess_cert_new();

ssl/s3_clnt.c

+1 −0
Original line number Diff line number Diff line
@@ -815,6 +815,7 @@ static int ssl3_get_server_certificate(SSL *s) 
		X509_free(s->session->peer);

	CRYPTO_add(&x->references,1,CRYPTO_LOCK_X509);

	s->session->peer=x;

	s->session->verify_result = s->verify_result;



	x=NULL;

	ret=1;

ssl/ssl_sess.c

+1 −0
Original line number Diff line number Diff line
@@ -508,6 +508,7 @@ int SSL_set_session(SSL *s, SSL_SESSION *session) 
		if (s->session != NULL)

			SSL_SESSION_free(s->session);

		s->session=session;

		s->verify_result = s->session->verify_result;

		/* CRYPTO_w_unlock(CRYPTO_LOCK_SSL);*/

		ret=1;

		}