Mercurial > hg > nginx

comparison src/stream/ngx_stream_ssl_module.c @ 7465:6708bec13757

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
SSL: adjusted session id context with dynamic certificates. Dynamic certificates re-introduce problem with incorrect session reuse (AKA "virtual host confusion", CVE-2014-3616), since there are no server certificates to generate session id context from. To prevent this, session id context is now generated from ssl_certificate directives as specified in the configuration. This approach prevents incorrect session reuse in most cases, while still allowing sharing sessions across multiple machines with ssl_session_ticket_key set as long as configurations are identical.
author Maxim Dounin <mdounin@mdounin.ru>
date Mon, 25 Feb 2019 16:42:54 +0300
parents e970de27966a
children 48c87377aabd
comparison
equal deleted inserted replaced
7464:e970de27966a 7465:6708bec13757
764 if (conf->shm_zone == NULL) { 764 if (conf->shm_zone == NULL) {
765 conf->shm_zone = prev->shm_zone; 765 conf->shm_zone = prev->shm_zone;
766 } 766 }
767 767
768 if (ngx_ssl_session_cache(&conf->ssl, &ngx_stream_ssl_sess_id_ctx, 768 if (ngx_ssl_session_cache(&conf->ssl, &ngx_stream_ssl_sess_id_ctx,
769 conf->builtin_session_cache, 769 conf->certificates, conf->builtin_session_cache,
770 conf->shm_zone, conf->session_timeout) 770 conf->shm_zone, conf->session_timeout)
771 != NGX_OK) 771 != NGX_OK)
772 { 772 {
773 return NGX_CONF_ERROR; 773 return NGX_CONF_ERROR;
774 } 774 }