From 33cfcfd9f0378625d3bddbd2c8ac5aad4b646f26 Mon Sep 17 00:00:00 2001 From: Jay Satiro Date: Wed, 22 Mar 2017 01:59:49 -0400 Subject: TLS: Fix switching off SSL session id when client cert is used Move the sessionid flag to ssl_primary_config so that ssl and proxy_ssl will each have their own sessionid flag. Regression since HTTPS-Proxy support was added in cb4e2be. Prior to that this issue had been fixed in 247d890, CVE-2016-5419. Bug: https://github.com/curl/curl/issues/1341 Reported-by: lijian996@users.noreply.github.com The new incarnation of this bug is called CVE-2017-7468 and is documented here: https://curl.haxx.se/docs/adv_20170419.html --- lib/url.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'lib/url.c') diff --git a/lib/url.c b/lib/url.c index 4609f4fda..caa28f5d4 100644 --- a/lib/url.c +++ b/lib/url.c @@ -546,7 +546,7 @@ CURLcode Curl_init_userdefined(struct UserDefined *set) #endif set->ssh_auth_types = CURLSSH_AUTH_DEFAULT; /* defaults to any auth type */ - set->general_ssl.sessionid = TRUE; /* session ID caching enabled by + set->ssl.primary.sessionid = TRUE; /* session ID caching enabled by default */ set->proxy_ssl = set->ssl; @@ -2499,8 +2499,9 @@ CURLcode Curl_setopt(struct Curl_easy *data, CURLoption option, break; case CURLOPT_SSL_SESSIONID_CACHE: - data->set.general_ssl.sessionid = (0 != va_arg(param, long)) ? + data->set.ssl.primary.sessionid = (0 != va_arg(param, long)) ? TRUE : FALSE; + data->set.proxy_ssl.primary.sessionid = data->set.ssl.primary.sessionid; break; #ifdef USE_LIBSSH2 -- cgit v1.2.3