Mercurial > hg > nginx
diff src/stream/ngx_stream_ssl_module.c @ 7465:6708bec13757
SSL: adjusted session id context with dynamic certificates.
Dynamic certificates re-introduce problem with incorrect session
reuse (AKA "virtual host confusion", CVE-2014-3616), since there are
no server certificates to generate session id context from.
To prevent this, session id context is now generated from ssl_certificate
directives as specified in the configuration. This approach prevents
incorrect session reuse in most cases, while still allowing sharing
sessions across multiple machines with ssl_session_ticket_key set as
long as configurations are identical.
author | Maxim Dounin <mdounin@mdounin.ru> |
---|---|
date | Mon, 25 Feb 2019 16:42:54 +0300 |
parents | e970de27966a |
children | 48c87377aabd |
line wrap: on
line diff
--- a/src/stream/ngx_stream_ssl_module.c Mon Feb 25 16:42:43 2019 +0300 +++ b/src/stream/ngx_stream_ssl_module.c Mon Feb 25 16:42:54 2019 +0300 @@ -766,7 +766,7 @@ } if (ngx_ssl_session_cache(&conf->ssl, &ngx_stream_ssl_sess_id_ctx, - conf->builtin_session_cache, + conf->certificates, conf->builtin_session_cache, conf->shm_zone, conf->session_timeout) != NGX_OK) {