kris/boringssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
95d3182576
boringssl/include/openssl
History
David Benjamin 95d3182576 Duplicate SSL_SESSIONs when renewing them. 
See also upstream's 27c76b9b8010b536687318739c6f631ce4194688, CVE-2015-1791.
Rather than write a dup function, serializing and deserializing the object is
simpler. It also fixes a bug in the original fix where it never calls
new_session_cb to store the new session (for clients which use that callback;
how clients should handle the session cache is much less clear).

The old session isn't pruned as we haven't processed the Finished message yet.
RFC 5077 says:

   The server MUST NOT assume that the client actually received the updated
   ticket until it successfully verifies the client's Finished message.

Moreover, because network messages are asynchronous, a new SSL connection may
have began just before the client received the new ticket, so any such servers
are broken regardless.

Change-Id: I13b3dc986dc58ea2ce66659dbb29e14cd02a641b
Reviewed-on: https://boringssl-review.googlesource.com/5122
Reviewed-by: Adam Langley <agl@google.com>
2015-06-16 18:15:12 +00:00
..
aead.h AEAD: allow _cleanup after failed _init. 2015-05-11 23:18:43 +00:00
aes.h Compatibility changes for wpa_supplicant and OpenSSH. 2015-04-14 20:18:28 +00:00
asn1_mac.h Prune away (almost) all of asn1_mac.h 2015-04-08 20:42:57 +00:00
asn1.h Support Trusty, an embedded platform. 2015-05-08 18:34:55 +00:00
asn1t.h Remove last references to named locks. 2015-05-20 19:18:30 +00:00
base64.h Various documentation fixes. 2015-01-14 21:50:50 +00:00
base.h Define OPENSSL_64_BIT for PowerPC chips. 2015-06-16 18:09:33 +00:00
bio.h Correct various documentation typos 2015-06-10 22:06:01 +00:00
blowfish.h Add decrepit, initially containing CAST and Blowfish. 2015-04-06 16:58:45 -07:00
bn.h Check for BN_copy failures. 2015-06-15 17:52:40 +00:00
buf.h Reset all the error codes. 2015-02-11 23:12:08 +00:00
buffer.h Add buffer.h for compatibility. 2015-05-12 00:09:57 +00:00
bytestring.h Correct various documentation typos 2015-06-10 22:06:01 +00:00
cast.h Add decrepit, initially containing CAST and Blowfish. 2015-04-06 16:58:45 -07:00
chacha.h
cipher.h Fix some malloc test crashs. 2015-05-21 18:00:10 +00:00
cmac.h Add support for CMAC (RFC 4493). 2015-05-07 21:13:41 +00:00
conf.h Eliminate unnecessary includes from low-level crypto modules. 2015-04-13 20:49:18 +00:00
cpu.h Never set RC4_CHAR. 2015-02-20 23:59:59 +00:00
crypto.h Fix |SSLeay|. 2015-05-20 17:44:44 +00:00
des.h Implement |DES_ede2_cbc_encrypt|. 2015-05-20 18:36:01 +00:00
dh.h Convert reference counts in crypto/ 2015-05-20 19:15:26 +00:00
digest.h Add |EVP_get_digestbyname|. 2015-06-03 21:34:07 +00:00
dsa.h Convert reference counts in crypto/ 2015-05-20 19:15:26 +00:00
dtls1.h Opaquify DTLS structs. 2015-05-08 18:02:02 +00:00
ec_key.h Correct various documentation typos 2015-06-10 22:06:01 +00:00
ec.h Correct various documentation typos 2015-06-10 22:06:01 +00:00
ecdh.h Reset all the error codes. 2015-02-11 23:12:08 +00:00
ecdsa.h Remove TODO about removing ECDSA_do_sign/ECDSA_do_verify. 2015-04-07 00:07:19 +00:00
engine.h Convert reference counts in crypto/ 2015-05-20 19:15:26 +00:00
err.h Correct various documentation typos 2015-06-10 22:06:01 +00:00
evp.h Correct various documentation typos 2015-06-10 22:06:01 +00:00
ex_data.h Correct various documentation typos 2015-06-10 22:06:01 +00:00
hkdf.h Implement HKDF. 2014-12-18 20:13:06 +00:00
hmac.h Remove HMAC_CTX_set_flags. 2015-06-02 01:07:07 +00:00
lhash_macros.h Remove hash table lookups from ex_data. 2015-04-15 23:59:35 +00:00
lhash.h Remove hash table lookups from ex_data. 2015-04-15 23:59:35 +00:00
md4.h Correct various documentation typos 2015-06-10 22:06:01 +00:00
md5.h Correct various documentation typos 2015-06-10 22:06:01 +00:00
mem.h Eliminate unnecessary includes from low-level crypto modules. 2015-04-13 20:49:18 +00:00
modes.h Add visibility rules. 2014-07-31 22:03:11 +00:00
obj_mac.h Remove fake RLE compression OID. 2015-05-27 21:49:39 +00:00
obj.h Correct various documentation typos 2015-06-10 22:06:01 +00:00
objects.h
opensslfeatures.h Remove remaining remnants of RIPEMD-160 support. 2015-03-17 21:03:42 +00:00
opensslv.h Get version-related functions from crypto.h rather than ssl.h. 2015-05-20 22:58:14 +00:00
ossl_typ.h
pem.h Correct various documentation typos 2015-06-10 22:06:01 +00:00
pkcs7.h
pkcs8.h Eliminate unnecessary includes from low-level crypto modules. 2015-04-13 20:49:18 +00:00
pkcs12.h
poly1305.h Always write the Poly1305 tag to an aligned buffer. 2015-01-14 23:38:25 +00:00
pqueue.h Export pqueue functions. 2014-09-03 21:38:19 +00:00
rand.h Add no-op |RAND_load_file| function for compatibility. 2015-05-12 00:36:11 +00:00
rc4.h Fix up whitespace in headers for doc.go. 2015-04-08 17:32:55 -07:00
rsa.h Correct various documentation typos 2015-06-10 22:06:01 +00:00
safestack.h Rename safe_stack.h to safestack.h. 2015-02-20 23:33:48 +00:00
sha.h Low-level hash 'final' functions cannot fail. 2015-06-01 22:14:01 +00:00
srtp.h Store SRTP_PROTECTION_PROFILES as const. 2015-01-14 22:10:08 +00:00
ssl2.h Rename ssl_locl.h to internal.h 2015-04-10 22:14:09 +00:00
ssl3.h Limit the number of warning alerts silently consumed. 2015-06-08 22:16:14 +00:00
ssl23.h Reformat SSL/TLS headers. 2015-01-26 20:23:09 +00:00
ssl.h Duplicate SSL_SESSIONs when renewing them. 2015-06-16 18:15:12 +00:00
stack_macros.h Multi-prime RSA support. 2015-06-05 18:39:44 +00:00
stack.h Multi-prime RSA support. 2015-06-05 18:39:44 +00:00
thread.h Readd CRYPTO_{LOCK|UNLOCK|READ|WRITE}. 2015-05-27 15:48:29 -07:00
time_support.h Eliminate unnecessary includes from low-level crypto modules. 2015-04-13 20:49:18 +00:00
tls1.h Add ECDHE-PSK-AES{128,256}-SHA cipher suites. 2015-06-09 18:10:42 +00:00
type_check.h Try to fix MSVC and __STDC_VERSION__ again. 2015-05-20 13:42:12 -07:00
x509_vfy.h Remove remaining calls to the old lock functions. 2015-05-20 19:18:13 +00:00
x509.h Convert reference counts in crypto/ 2015-05-20 19:15:26 +00:00
x509v3.h Remove spurious declarations of |X509V3_EXT_conf| and friends. 2015-05-05 00:22:59 +00:00