]> granicus.if.org Git - curl/commitdiff
TLS: switch off SSL session id when client cert is used
authorDaniel Stenberg <daniel@haxx.se>
Fri, 1 Jul 2016 11:32:31 +0000 (13:32 +0200)
committerDaniel Stenberg <daniel@haxx.se>
Tue, 2 Aug 2016 22:34:27 +0000 (00:34 +0200)
CVE-2016-5419
Bug: https://curl.haxx.se/docs/adv_20160803A.html
Reported-by: Bru Rom
Contributions-by: Eric Rescorla and Ray Satiro
lib/url.c
lib/urldata.h
lib/vtls/vtls.c

index 258a286812b52347da63d9f1f2ebac4ed6df5a9b..e547e5c16215a4d020859d48b96741a59485feb0 100644 (file)
--- a/lib/url.c
+++ b/lib/url.c
@@ -6123,6 +6123,7 @@ static CURLcode create_conn(struct Curl_easy *data,
   data->set.ssl.random_file = data->set.str[STRING_SSL_RANDOM_FILE];
   data->set.ssl.egdsocket = data->set.str[STRING_SSL_EGDSOCKET];
   data->set.ssl.cipher_list = data->set.str[STRING_SSL_CIPHER_LIST];
+  data->set.ssl.clientcert = data->set.str[STRING_CERT];
 #ifdef USE_TLS_SRP
   data->set.ssl.username = data->set.str[STRING_TLSAUTH_USERNAME];
   data->set.ssl.password = data->set.str[STRING_TLSAUTH_PASSWORD];
index 611c5a7062b456e9da5f5917439cd3157a23f477..3cf7ed9b2f4e2e4aa6a323c03ad8c6bfa885041d 100644 (file)
@@ -351,6 +351,7 @@ struct ssl_config_data {
   char *CAfile;          /* certificate to verify peer against */
   const char *CRLfile;   /* CRL to check certificate revocation */
   const char *issuercert;/* optional issuer certificate filename */
+  char *clientcert;
   char *random_file;     /* path to file containing "random" data */
   char *egdsocket;       /* path to file containing the EGD daemon socket */
   char *cipher_list;     /* list of ciphers to use */
index d3e41cdfd8366a20a05204891390febcd59d7ee9..33e209dc1288b0263862d4a19a612d91fdd76007 100644 (file)
@@ -156,6 +156,15 @@ Curl_clone_ssl_config(struct ssl_config_data *source,
   else
     dest->random_file = NULL;
 
+  if(source->clientcert) {
+    dest->clientcert = strdup(source->clientcert);
+    if(!dest->clientcert)
+      return FALSE;
+    dest->sessionid = FALSE;
+  }
+  else
+    dest->clientcert = NULL;
+
   return TRUE;
 }
 
@@ -166,6 +175,7 @@ void Curl_free_ssl_config(struct ssl_config_data* sslc)
   Curl_safefree(sslc->cipher_list);
   Curl_safefree(sslc->egdsocket);
   Curl_safefree(sslc->random_file);
+  Curl_safefree(sslc->clientcert);
 }