github-mirror/caddy
2
0
Fork 0
mirror of https://github.com/caddyserver/caddy.git synced 2024-11-29 12:16:16 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

tls: Prevent Go stdlib from overwriting our very first tls ticket key (#785)

Browse Source 
[1] 57e459e02b/src/crypto/tls/common.go (L424)
[2] 57e459e02b/src/crypto/tls/common.go (L392-L407)

[2] has overwritten the first tls ticket key on round N=0, that has previously
been written using [1].

Go's stdlib does not use c.sessionTicketKeys≥1 as indicator if those values had
already been set; initializing that lone SessionTicketKey does the job for for
now.
    If c.serverInit() were called in round N+1 all existing tls ticket keys
would be overwritten (in round N<4 except the very first one, of course).
As member variables of tls.Config are read-only by then, we cannot keep
updating SessionTicketKey as well.

This has been escalated to Go's authors with golang/go#15421 here:
https://github.com/golang/go/issues/15421

Thanks to Matthew Holt for the initial report!
This commit is contained in:
W. Mark Kubacki 2016-04-23 17:49:48 +02:00
parent 5c96ee1d9c
commit 6f5cff5393
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
server/server.go
View File

@ -445,6 +445,7 @@ func standaloneTLSTicketKeyRotation(c *tls.Config, timer *time.Ticker, exitChan
c.SessionTicketsDisabled = true // bail if we don't have the entropy for the first one c.SessionTicketsDisabled = true // bail if we don't have the entropy for the first one
return return
} }
c.SessionTicketKey = keys[0] // SetSessionTicketKeys doesn't set a 'tls.keysAlreadSet'
c.SetSessionTicketKeys(setSessionTicketKeysTestHook(keys)) c.SetSessionTicketKeys(setSessionTicketKeysTestHook(keys))
for { for {