Mailing List Archive: Apache: Dev

Re: svn commit: r833582 - in /httpd/httpd/trunk/modules/ssl: ssl_engine_init.c ssl_engine_io.c ssl_engine_kernel.c ssl_private.h

Index | Next | Previous | View Threaded

rpluem at apache

Nov 6, 2009, 3:37 PM

Post #1 of 3 (377 views)
Permalink

Re: svn commit: r833582 - in /httpd/httpd/trunk/modules/ssl: ssl_engine_init.c ssl_engine_io.c ssl_engine_kernel.c ssl_private.h

On 11/06/2009 11:33 PM, jorton [at] apache wrote:
> Author: jorton
> Date: Fri Nov 6 22:33:19 2009
> New Revision: 833582
>
> URL: http://svn.apache.org/viewvc?rev=833582&view=rev
> Log:
> SECURITY: Partial fix for CVE-2009-3555:
>

Looks good. Passes all tests in the framework (should we add one for CVE-2009-3555?)
Backporting to 2.2.x has a little conflict in ssl_engine_io.c which is resolved in the
attached patch which backports r833582 and r833593.
This patch also passes all tests.

Regards

Rüdiger

Attachments:

r833582_and_833593-backport-2.2.x.diff (10.6 KB)

jorton at redhat

Nov 6, 2009, 4:08 PM

Post #2 of 3 (364 views)
Permalink

Re: svn commit: r833582 - in /httpd/httpd/trunk/modules/ssl: ssl_engine_init.c ssl_engine_io.c ssl_engine_kernel.c ssl_private.h [In reply to]

On Sat, Nov 07, 2009 at 12:37:56AM +0100, Ruediger Pluem wrote:
> On 11/06/2009 11:33 PM, jorton [at] apache wrote:
> > Author: jorton
> > Date: Fri Nov 6 22:33:19 2009
> > New Revision: 833582
> >
> > URL: http://svn.apache.org/viewvc?rev=833582&view=rev
> > Log:
> > SECURITY: Partial fix for CVE-2009-3555:
>
> Looks good. Passes all tests in the framework (should we add one for CVE-2009-3555?)
> Backporting to 2.2.x has a little conflict in ssl_engine_io.c which is resolved in the
> attached patch which backports r833582 and r833593.
> This patch also passes all tests.

Awesome, thanks a lot!

+1 for backport to 2.2.x here too.

I doubt it's possible to test this from perl-framework since it won't
expose a way to trigger a renegotiation from the client, unfortunately.

Regards, Joe

dirkx at webweaving

Nov 6, 2009, 4:23 PM

Post #3 of 3 (369 views)
Permalink

Re: svn commit: r833582 - in /httpd/httpd/trunk/modules/ssl: ssl_engine_init.c ssl_engine_io.c ssl_engine_kernel.c ssl_private.h [In reply to]

Joe Orton wrote:
> Awesome, thanks a lot!
>
> +1 for backport to 2.2.x here too.
+1 here from me as well.

So the trunk patch is

svn diff -r833581:833594 \
https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl

> I doubt it's possible to test this from perl-framework since it won't
> expose a way to trigger a renegotiation from the client, unfortunately.

perhaps 'echo R | openssl s_client' ... with some clever chat/expect ?

Thanks,

Dw

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads