[openssl-commits] [openssl] OpenSSL source code branch OpenSSL_1_0_2-stable updated. OpenSSL_1_0_2-beta3-142-gd9b277e

[Emilia Kasper]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "OpenSSL source code".

The branch, OpenSSL_1_0_2-stable has been updated
       via  d9b277e085988598945463b0ad12a6321556252b (commit)
      from  aace6dbcb34ba40e9b5ef2da11d3d3e724599ca9 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit d9b277e085988598945463b0ad12a6321556252b
Author: Adam Langley <agl at chromium.org>
Date:   Mon Jan 5 17:28:33 2015 +0100

    Ensure that the session ID context of an SSL* is updated
    when its SSL_CTX is updated.
    
    From BoringSSL commit
    https://boringssl.googlesource.com/boringssl/+/a5dc545bbcffd9c24cebe65e9ab5ce72d4535e3a
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    (cherry picked from commit 61aa44ca99473f9cabdfb2d3b35abd0b473437d1)

-----------------------------------------------------------------------

Summary of changes:
 CHANGES       |    7 +++++++
 ssl/ssl_lib.c |   15 +++++++++++++++
 2 files changed, 22 insertions(+)

diff --git a/CHANGES b/CHANGES
index 5b2f388..1880a46 100644
--- a/CHANGES
+++ b/CHANGES
@@ -365,6 +365,13 @@
 
  Changes between 1.0.1j and 1.0.1k [xx XXX xxxx]
 
+  *) Ensure that the session ID context of an SSL is updated when its
+     SSL_CTX is updated via SSL_set_SSL_CTX.
+
+     The session ID context is typically set from the parent SSL_CTX,
+     and can vary with the CTX.
+     [Adam Langley]
+
   *) Fix various certificate fingerprint issues.
 
      By using non-DER or invalid encodings outside the signed portion of a
diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c
index cd4ea68..64c9eab 100644
--- a/ssl/ssl_lib.c
+++ b/ssl/ssl_lib.c
@@ -3198,6 +3198,21 @@ SSL_CTX *SSL_set_SSL_CTX(SSL *ssl, SSL_CTX* ctx)
 	if (ssl->ctx != NULL)
 		SSL_CTX_free(ssl->ctx); /* decrement reference count */
 	ssl->ctx = ctx;
+
+	/*
+	 * Inherit the session ID context as it is typically set from the
+	 * parent SSL_CTX, and can vary with the CTX.
+	 * Note that per-SSL SSL_set_session_id_context() will not persist
+	 * if called before SSL_set_SSL_CTX.
+	 */
+	ssl->sid_ctx_length = ctx->sid_ctx_length;
+	/*
+	 * Program invariant: |sid_ctx| has fixed size (SSL_MAX_SID_CTX_LENGTH),
+	 * so setter APIs must prevent invalid lengths from entering the system.
+	 */
+	OPENSSL_assert(ssl->sid_ctx_length <= sizeof ssl->sid_ctx);
+	memcpy(&ssl->sid_ctx, &ctx->sid_ctx, sizeof(ssl->sid_ctx));
+
 	return(ssl->ctx);
 	}
 


hooks/post-receive
-- 
OpenSSL source code