Hello! On Thu, Sep 18, 2014 at 07:18:28PM +1000, Matt Palmer wrote:
> On Thu, Sep 18, 2014 at 11:14:06AM +0300, Christos Trochalakis wrote: > > Salvatore Bonaccorso (cc'd) of the Debian Security Team has prepared a > > combined patch backporting the upstream commit and other bits needed > > (ngx_ssl_certificate_index). He has uploaded the patch here: > > > > https://people.debian.org/~carnil/tmp/nginx/nginx_1.2.1-2.2+wheezy3.debdiff > > https://people.debian.org/~carnil/tmp/nginx/ > > > > We would appreciate it if someone could double-check the patch. > > Yeah, that ain't going to fly. The data behind ngx_ssl_certificate_index is > never getting initialized. Why don't you just use the patch I put together > for the LTS upload I did a couple of days ago? I haven't seen the patch you've prepared, but for 1.2.x and 1.4.x it should be better to avoid complexity introduced in the 1.7.x/1.6.x and just use a random value for session id context, as there is no support for shared TLS Session Tickets. Patch should be as trivial as: --- a/src/event/ngx_event_openssl.c +++ b/src/event/ngx_event_openssl.c @@ -1531,14 +1531,16 @@ ngx_int_t ngx_ssl_session_cache(ngx_ssl_t *ssl, ngx_str_t *sess_ctx, ssize_t builtin_session_cache, ngx_shm_zone_t *shm_zone, time_t timeout) { - long cache_mode; + long cache_mode; + u_char buf[16]; if (builtin_session_cache == NGX_SSL_NO_SCACHE) { SSL_CTX_set_session_cache_mode(ssl->ctx, SSL_SESS_CACHE_OFF); return NGX_OK; } - SSL_CTX_set_session_id_context(ssl->ctx, sess_ctx->data, sess_ctx->len); + RAND_pseudo_bytes(buf, 16); + SSL_CTX_set_session_id_context(ssl->ctx, buf, 16); if (builtin_session_cache == NGX_SSL_NONE_SCACHE) { (Against stable-1.2 branch in nginx repo.) Alternatively, trivial configuration-level workarounds can be used to avoid virtual host confusion if it can be important in a particular configuration, see the paper for details. -- Maxim Dounin http://nginx.org/ _______________________________________________ nginx-devel mailing list [email protected] http://mailman.nginx.org/mailman/listinfo/nginx-devel
