From fafbab1a3a52a383d92d2b5b1fb63785a15f2d73 Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <[email protected]>
Date: Fri, 19 Dec 2014 08:50:00 +0100
Subject: [PATCH] darwinssl: fix session ID keys to only reuse identical
sessions
...to avoid a session ID getting cached without certificate checking and
then after a subsequent _enabling_ of the check libcurl could still
re-use the session done without cert checks.
Bug: http://curl.haxx.se/docs/adv_20150108A.html
Reported-by: Marc Hesse
---
lib/vtls/curl_darwinssl.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
This fix is already available upstream in curl version 7.40.0
--- lib/vtls/curl_darwinssl.c.orig 2015-01-05 16:57:56.063227733 -0800
+++ lib/vtls/curl_darwinssl.c 2015-01-05 16:58:54.820470409 -0800
@@ -1483,7 +1483,10 @@
else {
CURLcode retcode;
- ssl_sessionid = malloc(256*sizeof(char));
+ ssl_sessionid =
+ aprintf("%s:%d:%d:%s:%hu", data->set.str[STRING_SSL_CAFILE],
+ data->set.ssl.verifypeer, data->set.ssl.verifyhost,
+ conn->host.name, conn->remote_port);
ssl_sessionid_len = snprintf(ssl_sessionid, 256, "curl:%s:%hu",
conn->host.name, conn->remote_port);
err = SSLSetPeerID(connssl->ssl_ctx, ssl_sessionid, ssl_sessionid_len);