Blame SOURCES/0042-curl-7.29.0-CVE-2016-5419.patch

105fd7
From a22c0daa87598a016bf0b5c93bb2ff63be5577f9 Mon Sep 17 00:00:00 2001
105fd7
From: Paul Donohue <curl@paulsd.com>
105fd7
Date: Tue, 15 Oct 2013 21:36:32 +0200
105fd7
Subject: [PATCH 1/2] NSS: acknowledge the
105fd7
 --no-sessionid/CURLOPT_SSL_SESSIONID_CACHE option
105fd7
105fd7
Upstream-commit: f63603dec4519857498602f7a00acc0ffed29753
105fd7
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
105fd7
---
105fd7
 lib/nss.c | 5 +++--
105fd7
 1 file changed, 3 insertions(+), 2 deletions(-)
105fd7
105fd7
diff --git a/lib/nss.c b/lib/nss.c
105fd7
index 83bb354..1f02988 100644
105fd7
--- a/lib/nss.c
105fd7
+++ b/lib/nss.c
105fd7
@@ -1362,8 +1362,9 @@ static CURLcode nss_setup_connect(struct connectdata *conn, int sockindex)
105fd7
   if(SSL_OptionSet(model, SSL_HANDSHAKE_AS_CLIENT, PR_TRUE) != SECSuccess)
105fd7
     goto error;
105fd7
 
105fd7
-  /* do not use SSL cache if we are not going to verify peer */
105fd7
-  ssl_no_cache = (data->set.ssl.verifypeer) ? PR_FALSE : PR_TRUE;
105fd7
+  /* do not use SSL cache if disabled or we are not going to verify peer */
105fd7
+  ssl_no_cache = (conn->ssl_config.sessionid && data->set.ssl.verifypeer) ?
105fd7
+    PR_FALSE : PR_TRUE;
105fd7
   if(SSL_OptionSet(model, SSL_NO_CACHE, ssl_no_cache) != SECSuccess)
105fd7
     goto error;
105fd7
 
105fd7
-- 
105fd7
2.5.5
105fd7
105fd7
105fd7
From e164f1a355900f7f164d28ac9f937ad82d9ca45f Mon Sep 17 00:00:00 2001
105fd7
From: Daniel Stenberg <daniel@haxx.se>
105fd7
Date: Fri, 1 Jul 2016 13:32:31 +0200
105fd7
Subject: [PATCH 2/2] TLS: switch off SSL session id when client cert is used
105fd7
105fd7
CVE-2016-5419
105fd7
Bug: https://curl.haxx.se/docs/adv_20160803A.html
105fd7
Reported-by: Bru Rom
105fd7
Contributions-by: Eric Rescorla and Ray Satiro
105fd7
105fd7
Upstream-commit: 247d890da88f9ee817079e246c59f3d7d12fde5f
105fd7
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
105fd7
---
105fd7
 lib/sslgen.c  | 10 ++++++++++
105fd7
 lib/url.c     |  1 +
105fd7
 lib/urldata.h |  1 +
105fd7
 3 files changed, 12 insertions(+)
105fd7
105fd7
diff --git a/lib/sslgen.c b/lib/sslgen.c
105fd7
index 4875874..3036bb2 100644
105fd7
--- a/lib/sslgen.c
105fd7
+++ b/lib/sslgen.c
105fd7
@@ -147,6 +147,15 @@ Curl_clone_ssl_config(struct ssl_config_data *source,
105fd7
   else
105fd7
     dest->random_file = NULL;
105fd7
 
105fd7
+  if(source->clientcert) {
105fd7
+    dest->clientcert = strdup(source->clientcert);
105fd7
+    if(!dest->clientcert)
105fd7
+      return FALSE;
105fd7
+    dest->sessionid = FALSE;
105fd7
+  }
105fd7
+  else
105fd7
+    dest->clientcert = NULL;
105fd7
+
105fd7
   return TRUE;
105fd7
 }
105fd7
 
105fd7
@@ -157,6 +166,7 @@ void Curl_free_ssl_config(struct ssl_config_data* sslc)
105fd7
   Curl_safefree(sslc->cipher_list);
105fd7
   Curl_safefree(sslc->egdsocket);
105fd7
   Curl_safefree(sslc->random_file);
105fd7
+  Curl_safefree(sslc->clientcert);
105fd7
 }
105fd7
 
105fd7
 #ifdef USE_SSL
105fd7
diff --git a/lib/url.c b/lib/url.c
105fd7
index 7257b5e..959510d 100644
105fd7
--- a/lib/url.c
105fd7
+++ b/lib/url.c
105fd7
@@ -5255,6 +5255,7 @@ static CURLcode create_conn(struct SessionHandle *data,
105fd7
   data->set.ssl.random_file = data->set.str[STRING_SSL_RANDOM_FILE];
105fd7
   data->set.ssl.egdsocket = data->set.str[STRING_SSL_EGDSOCKET];
105fd7
   data->set.ssl.cipher_list = data->set.str[STRING_SSL_CIPHER_LIST];
105fd7
+  data->set.ssl.clientcert = data->set.str[STRING_CERT];
105fd7
 #ifdef USE_TLS_SRP
105fd7
   data->set.ssl.username = data->set.str[STRING_TLSAUTH_USERNAME];
105fd7
   data->set.ssl.password = data->set.str[STRING_TLSAUTH_PASSWORD];
105fd7
diff --git a/lib/urldata.h b/lib/urldata.h
105fd7
index 723e40d..f4c6222 100644
105fd7
--- a/lib/urldata.h
105fd7
+++ b/lib/urldata.h
105fd7
@@ -340,6 +340,7 @@ struct ssl_config_data {
105fd7
   char *CAfile;          /* certificate to verify peer against */
105fd7
   const char *CRLfile;   /* CRL to check certificate revocation */
105fd7
   const char *issuercert;/* optional issuer certificate filename */
105fd7
+  char *clientcert;
105fd7
   char *random_file;     /* path to file containing "random" data */
105fd7
   char *egdsocket;       /* path to file containing the EGD daemon socket */
105fd7
   char *cipher_list;     /* list of ciphers to use */
105fd7
-- 
105fd7
2.5.5
105fd7