Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 1104597
Summary: | wrong re-use of a session cache entry | ||||||
---|---|---|---|---|---|---|---|
Product: | [Fedora] Fedora | Reporter: | Kamil Dudka <kdudka> | ||||
Component: | curl | Assignee: | Kamil Dudka <kdudka> | ||||
Status: | CLOSED NEXTRELEASE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||
Severity: | unspecified | Docs Contact: | |||||
Priority: | unspecified | ||||||
Version: | 22 | CC: | aurelien, ben.r.xiao, bugzilla, emaldona, igeorgex, kdudka, kengert, nsalter, paul, pierre-bugzilla, wvoyek | ||||
Target Milestone: | --- | Keywords: | Patch | ||||
Target Release: | --- | ||||||
Hardware: | Unspecified | ||||||
OS: | Unspecified | ||||||
Whiteboard: | |||||||
Fixed In Version: | 7.40.0-7.fc22 | Doc Type: | Bug Fix | ||||
Doc Text: | Story Points: | --- | |||||
Clone Of: | Environment: | ||||||
Last Closed: | 2015-09-21 10:47:27 UTC | Type: | Bug | ||||
Regression: | --- | Mount Type: | --- | ||||
Documentation: | --- | CRM: | |||||
Verified Versions: | Category: | --- | |||||
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
Cloudforms Team: | --- | Target Upstream Version: | |||||
Embargoed: | |||||||
Bug Depends On: | |||||||
Bug Blocks: | 1098711, 1241172 | ||||||
Attachments: |
|
Description
Kamil Dudka
2014-06-04 10:04:31 UTC
Created attachment 902122 [details]
[PATCH] ssl: require server name to match in ssl_LookupSID()
I can confirm that this is also happening with libcurl 7.19.7 using NSS 3.15.3. When switching connection between two different hosts which share the same certificate (and probably IP), it will reuse the TLS handshake from the previous request which causes many server applications (such as Apache) to return a 400 error. Interestingly enough it will continue to use the incorrect handshake even when the server returns non-200 responses. Tested using openssl fixes the issue with definitely implies that there's a problem with the NSS lib. Example (PHP) code to replicate the issue: http://pastebin.com/K7JhCLsz This bug appears to have been reported against 'rawhide' during the Fedora 22 development cycle. Changing version to '22'. More information and reason for this action is here: https://fedoraproject.org/wiki/Fedora_Program_Management/HouseKeeping/Fedora22 Elio, have you had time to look at the patch for this bug I posted a year ago? (In reply to Kamil Dudka from comment #4) Sorry for the delay, as you can see I just filed an upstream bug with a pointer to your patch and we are already getting comments. Mozilla upstream suggested a workaround for curl: https://github.com/bagder/curl/commit/958d2ffb I will put the patch into Fedora... fixed in curl-7.44.0-2.fc24 curl-7.43.0-4.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2015-16178 curl-7.43.0-4.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report.\nIf you want to test the update, you can install it with \n su -c 'yum --enablerepo=updates-testing update curl'. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-16178 curl-7.40.0-7.fc22 has been pushed to the Fedora 22 testing repository. If problems still persist, please make note of it in this bug report.\nIf you want to test the update, you can install it with \n su -c 'yum --enablerepo=updates-testing update curl'. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-16177 curl-7.43.0-4.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report. I can confirm that curl-7.40.0-7.fc22 fixes the issues with owncloud complaining that it doesn't have an internet connection: Bug 1241172 Thanks for the fix curl-7.40.0-7.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report. |