romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-28 19:03:06 +03:00
Code Issues Projects Releases Packages Wiki Activity

OpenSSL: check reuse of sessions for verify status

Browse source 
OpenSSL records its peer verification status inside its SSL_SESSION
objects. When a session is later reused, the SSL connection inherits
this verify status.

Session keys prevent reuse of sessions between connections that verify
the peer and those who do not. However, when Apple SecTrust is used
to verify a connection, this does not update the Sessions verify
status (and there is no setter). On session reuse, OpenSSL fails
the verification and Apple SecTrust cannot verify either since the
certificate peer chain is not available.

Fix this by checking the verification status on session reuse and
remove the session again if the peer needs to be verified, but the
session is not.

Reported-by: Christian Schmitza
Fixes #20435
Closes #20446
This commit is contained in:
Stefan Eissing 2026-01-27 13:28:09 +01:00 • committed by Daniel Stenberg
parent af508e3641
commit 065b149df0
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
7 changed files with 73 additions and 37 deletions
Download patch file Download diff file Expand all files Collapse all files

2
lib/vtls/gtls.c
View file

@ -1572,8 +1572,6 @@ static CURLcode glts_apple_verify(struct Curl_cfilter *cf,
result = Curl_vtls_apple_verify(cf, data, peer, chain->num_certs,
gtls_chain_get_der, chain, NULL, 0);
*pverified = !result;
if(*pverified)
infof(data, " SSL certificate verified by Apple SecTrust.");
return result;
}
#endif /* USE_APPLE_SECTRUST */

64
lib/vtls/openssl.c
View file

@ -3371,32 +3371,42 @@ ossl_init_session_and_alpns(struct ossl_ctx *octx,
sizeof(error_buffer)));
}
else {
infof(data, "SSL reusing session with ALPN '%s'",
scs->alpn ? scs->alpn : "-");
octx->reused_session = TRUE;
if(conn_cfg->verifypeer &&
(SSL_get_verify_result(octx->ssl) != X509_V_OK)) {
/* Session was from unverified connection, cannot reuse here */
SSL_set_session(octx->ssl, NULL);
infof(data, "SSL session not peer verified, not reusing");
}
else {
infof(data, "SSL reusing session with ALPN '%s'",
scs->alpn ? scs->alpn : "-");
octx->reused_session = TRUE;
infof(data, "SSL verify result: %lx",
SSL_get_verify_result(octx->ssl));
#ifdef HAVE_OPENSSL_EARLYDATA
if(ssl_config->earlydata && scs->alpn &&
SSL_SESSION_get_max_early_data(ssl_session) &&
!cf->conn->connect_only &&
(SSL_version(octx->ssl) == TLS1_3_VERSION)) {
bool do_early_data = FALSE;
if(sess_reuse_cb) {
result = sess_reuse_cb(cf, data, &alpns, scs, &do_early_data);
if(result) {
SSL_SESSION_free(ssl_session);
return result;
if(ssl_config->earlydata && scs->alpn &&
SSL_SESSION_get_max_early_data(ssl_session) &&
!cf->conn->connect_only &&
(SSL_version(octx->ssl) == TLS1_3_VERSION)) {
bool do_early_data = FALSE;
if(sess_reuse_cb) {
result = sess_reuse_cb(cf, data, &alpns, scs, &do_early_data);
if(result) {
SSL_SESSION_free(ssl_session);
return result;
}
}
if(do_early_data) {
/* We only try the ALPN protocol the session used before,
* otherwise we might send early data for the wrong protocol */
Curl_alpn_restrict_to(&alpns, scs->alpn);
}
}
if(do_early_data) {
/* We only try the ALPN protocol the session used before,
* otherwise we might send early data for the wrong protocol */
Curl_alpn_restrict_to(&alpns, scs->alpn);
}
}
#else
(void)ssl_config;
(void)sess_reuse_cb;
(void)ssl_config;
(void)sess_reuse_cb;
#endif
}
}
SSL_SESSION_free(ssl_session);
}
@ -4681,8 +4691,15 @@ static CURLcode ossl_apple_verify(struct Curl_cfilter *cf,
if(!chain.num_certs &&
(conn_config->verifypeer || conn_config->verifyhost)) {
failf(data, "SSL: could not get peer certificate");
result = CURLE_PEER_FAILED_VERIFICATION;
if(!octx->reused_session) {
failf(data, "SSL: could not get peer certificate chain");
result = CURLE_PEER_FAILED_VERIFICATION;
}
else {
/* when session was reused, there is no peer cert chain */
*pverified = FALSE;
return CURLE_OK;
}
}
else {
#ifdef HAVE_BORINGSSL_LIKE
@ -4758,6 +4775,7 @@ CURLcode Curl_ossl_check_peer_cert(struct Curl_cfilter *cf,
ossl_verify = SSL_get_verify_result(octx->ssl);
ssl_config->certverifyresult = ossl_verify;
infof(data, "OpenSSL verify result: %lx", ossl_verify);
verified = (ossl_verify == X509_V_OK);
if(verified)