Changeset 72b669e in mod_gnutls for include/mod_gnutls.h.in


Ignore:
Timestamp:
Sep 27, 2018, 1:23:25 PM (20 months ago)
Author:
Fiona Klute <fiona.klute@…>
Branches:
debian/master, master, proxy-ticket
Children:
c33ef88
Parents:
514d4d6
Message:

Refuse to send or receive over a failed TLS connection

On a failed connection (e.g. after a refused handshake) the
input/output filters would pass data unprocessed to the next filter in
the chain. On a normal server this just led to odd log messages
(because the HTTP handler couldn't process whatever the client was
sending), but for proxy HTTPS connections it caused a security issue:
The proxy request would be sent unencrypted after the failed
handshake, and the connection only closed when mod_proxy didn't
receive a valid response.

The fix is to refuse any send or receive operations through the
filters if the TLS connection failed.

File:
1 edited

Legend:

Unmodified
Added
Removed
  • include/mod_gnutls.h.in

    r514d4d6 r72b669e  
    204204} mgs_char_buffer_t;
    205205
    206 /* GnuTLS Handle */
     206/** GnuTLS connection handle */
    207207typedef struct {
    208208        /* Server configuration record */
     
    242242        /* Output length */
    243243    apr_size_t output_length;
    244         /* General Status */
     244    /** Connection status: 0 before (re-)handshake, 1 when up, -1 on
     245     * error (checks use status < 0 or status > 0) */
    245246    int status;
    246247} mgs_handle_t;
Note: See TracChangeset for help on using the changeset viewer.