]> git.ipfire.org Git - thirdparty/haproxy.git/commit
MEDIUM: ssl: protect against client-initiated renegociation
authorEmeric Brun <ebrun@exceliance.fr>
Mon, 3 Sep 2012 18:36:47 +0000 (20:36 +0200)
committerWilly Tarreau <w@1wt.eu>
Mon, 3 Sep 2012 20:03:17 +0000 (22:03 +0200)
commite1f38dbb44ed7947a1036f7b267e9c2ca8aa9116
treed148c6d4610fd32f4d7f278fcc0a617acf17c640
parent01f8e2f61b099b0d9270b84cd77cf091fe1d310d
MEDIUM: ssl: protect against client-initiated renegociation

CVE-2009-3555 suggests that client-initiated renegociation should be
prevented in the middle of data. The workaround here consists in having
the SSL layer notify our callback about a handshake occurring, which in
turn causes the connection to be marked in the error state if it was
already considered established (which means if a previous handshake was
completed). The result is that the connection with the client is immediately
aborted and any pending data are dropped.
include/proto/ssl_sock.h
src/cfgparse.c
src/ssl_sock.c