|
 |
e955dd2 |
From 98dee5ab5a862a506beb8a7bf60c0aaec3b08a0f Mon Sep 17 00:00:00 2001
|
|
|
e955dd2 |
From: Kamil Dudka <kdudka@redhat.com>
|
|
|
e955dd2 |
Date: Fri, 18 Sep 2015 17:07:22 +0200
|
|
|
e955dd2 |
Subject: [PATCH 1/2] nss: check return values of NSS functions
|
|
|
e955dd2 |
|
|
|
e955dd2 |
Upstream-commit: a9fd53887ba07cd8313a8b9706f2dc71d6b8ed1b
|
|
|
e955dd2 |
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
|
|
|
e955dd2 |
---
|
|
|
e955dd2 |
lib/vtls/nss.c | 8 ++++++--
|
|
|
e955dd2 |
1 file changed, 6 insertions(+), 2 deletions(-)
|
|
|
e955dd2 |
|
|
|
e955dd2 |
diff --git a/lib/vtls/nss.c b/lib/vtls/nss.c
|
|
|
e955dd2 |
index 91727c7..1fa1c64 100644
|
|
|
e955dd2 |
--- a/lib/vtls/nss.c
|
|
|
e955dd2 |
+++ b/lib/vtls/nss.c
|
|
|
e955dd2 |
@@ -1792,9 +1792,13 @@ static CURLcode nss_setup_connect(struct connectdata *conn, int sockindex)
|
|
|
e955dd2 |
|
|
|
e955dd2 |
|
|
|
e955dd2 |
/* Force handshake on next I/O */
|
|
|
e955dd2 |
- SSL_ResetHandshake(connssl->handle, /* asServer */ PR_FALSE);
|
|
|
e955dd2 |
+ if(SSL_ResetHandshake(connssl->handle, /* asServer */ PR_FALSE)
|
|
|
e955dd2 |
+ != SECSuccess)
|
|
|
e955dd2 |
+ goto error;
|
|
|
e955dd2 |
|
|
|
e955dd2 |
- SSL_SetURL(connssl->handle, conn->host.name);
|
|
|
e955dd2 |
+ /* propagate hostname to the TLS layer */
|
|
|
e955dd2 |
+ if(SSL_SetURL(connssl->handle, conn->host.name) != SECSuccess)
|
|
|
e955dd2 |
+ goto error;
|
|
|
e955dd2 |
|
|
|
e955dd2 |
return CURLE_OK;
|
|
|
e955dd2 |
|
|
|
e955dd2 |
--
|
|
|
e955dd2 |
2.5.2
|
|
|
e955dd2 |
|
|
|
e955dd2 |
|
|
|
e955dd2 |
From d082ad368ecec7894d8e9e9a35336b2350c30ade Mon Sep 17 00:00:00 2001
|
|
|
e955dd2 |
From: Kamil Dudka <kdudka@redhat.com>
|
|
|
e955dd2 |
Date: Fri, 18 Sep 2015 17:10:05 +0200
|
|
|
e955dd2 |
Subject: [PATCH 2/2] nss: prevent NSS from incorrectly re-using a session
|
|
|
e955dd2 |
|
|
|
e955dd2 |
Without this workaround, NSS re-uses a session cache entry despite the
|
|
|
e955dd2 |
server name does not match. This causes SNI host name to differ from
|
|
|
e955dd2 |
the actual host name. Consequently, certain servers (e.g. github.com)
|
|
|
e955dd2 |
respond by 400 to such requests.
|
|
|
e955dd2 |
|
|
|
e955dd2 |
Bug: https://bugzilla.mozilla.org/1202264
|
|
|
e955dd2 |
|
|
|
e955dd2 |
Upstream-commit: 958d2ffb198166a062a0ff20d009c64972a2b374
|
|
|
e955dd2 |
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
|
|
|
e955dd2 |
---
|
|
|
e955dd2 |
lib/vtls/nss.c | 4 ++++
|
|
|
e955dd2 |
1 file changed, 4 insertions(+)
|
|
|
e955dd2 |
|
|
|
e955dd2 |
diff --git a/lib/vtls/nss.c b/lib/vtls/nss.c
|
|
|
e955dd2 |
index 1fa1c64..3d73ffe 100644
|
|
|
e955dd2 |
--- a/lib/vtls/nss.c
|
|
|
e955dd2 |
+++ b/lib/vtls/nss.c
|
|
|
e955dd2 |
@@ -1800,6 +1800,10 @@ static CURLcode nss_setup_connect(struct connectdata *conn, int sockindex)
|
|
|
e955dd2 |
if(SSL_SetURL(connssl->handle, conn->host.name) != SECSuccess)
|
|
|
e955dd2 |
goto error;
|
|
|
e955dd2 |
|
|
|
e955dd2 |
+ /* prevent NSS from re-using the session for a different hostname */
|
|
|
e955dd2 |
+ if(SSL_SetSockPeerID(connssl->handle, conn->host.name) != SECSuccess)
|
|
|
e955dd2 |
+ goto error;
|
|
|
e955dd2 |
+
|
|
|
e955dd2 |
return CURLE_OK;
|
|
|
e955dd2 |
|
|
|
e955dd2 |
error:
|
|
|
e955dd2 |
--
|
|
|
e955dd2 |
2.5.2
|
|
|
e955dd2 |
|