GitLab/ocserv
1
0
Fork 0
mirror of https://gitlab.com/openconnect/ocserv.git synced 2026-08-08 01:11:49 +08:00
Code Issues Packages Projects Releases Wiki Activity

sec-mod, worker: harden TLS resumption cache against empty session data

Browse Source 
A cached resume entry can end up with zero-length session_data, which is
not valid resumption data.

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
This commit is contained in:
Nikos Mavrogiannopoulos
2026-07-28 08:07:07 +02:00
parent 9e71c1b8b6
commit 77e06aec8a
2 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/sec-mod-resume.c
+2 -1
View File
@@ -126,7 +126,8 @@ int handle_resume_store_req(sec_mod_st *sec,
if (req->session_id.len > GNUTLS_MAX_SESSION_ID)
return -1;
if (req->session_data.len > MAX_SESSION_DATA_SIZE)
if (req->session_data.len == 0 ||
req->session_data.len > MAX_SESSION_DATA_SIZE)
return -1;
max = MAX(2 * GETRCONFIG(sec)->max_clients,
src/worker-resume.c
+2 -1
View File
@@ -54,7 +54,8 @@ static int recv_resume_fetch_reply(worker_st *ws, int sd, gnutls_datum_t *sdata)
return ret;
}
if (resp->reply != SESSION_RESUME_REPLY_MSG__RESUME__REP__OK) {
if (resp->reply != SESSION_RESUME_REPLY_MSG__RESUME__REP__OK ||
resp->session_data.len == 0) {
ret = -1;
goto cleanup;
}