romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-24 15:23:36 +03:00
Code Issues Projects Releases Packages Wiki Activity

TLS: Fix switching off SSL session id when client cert is used

Browse source 
Move the sessionid flag to ssl_primary_config so that ssl and proxy_ssl
will each have their own sessionid flag.

Regression since HTTPS-Proxy support was added in cb4e2be. Prior to that
this issue had been fixed in 247d890, CVE-2016-5419.

Bug: https://github.com/curl/curl/issues/1341
Reported-by: lijian996@users.noreply.github.com

The new incarnation of this bug is called CVE-2017-7468 and is documented
here: https://curl.haxx.se/docs/adv_20170419.html
This commit is contained in:
Jay Satiro 2017-03-22 01:59:49 -04:00 • committed by Daniel Stenberg
parent 997504ea50
commit 33cfcfd9f0
12 changed files with 26 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

5
lib/url.c
View file

@ -546,7 +546,7 @@ CURLcode Curl_init_userdefined(struct UserDefined *set)
#endif
set->ssh_auth_types = CURLSSH_AUTH_DEFAULT; /* defaults to any auth
type */
set->general_ssl.sessionid = TRUE; /* session ID caching enabled by
set->ssl.primary.sessionid = TRUE; /* session ID caching enabled by
default */
set->proxy_ssl = set->ssl;
@ -2499,8 +2499,9 @@ CURLcode Curl_setopt(struct Curl_easy *data, CURLoption option,
break;
case CURLOPT_SSL_SESSIONID_CACHE:
data->set.general_ssl.sessionid = (0 != va_arg(param, long)) ?
data->set.ssl.primary.sessionid = (0 != va_arg(param, long)) ?
TRUE : FALSE;
data->set.proxy_ssl.primary.sessionid = data->set.ssl.primary.sessionid;
break;
#ifdef USE_LIBSSH2