[TS-3125] SSL ctx is set to a constant allowing for potential inappropriate session reuse.

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 5.2.0
• Component/s: Core, SSL
• Assignee: Brian Geffon
• Reporter: Brian Geffon
• Created: 09/Oct/14 22:23
• Updated: 15/Oct/14 00:51
• Resolved: 10/Oct/14 20:01

Description

We have the following chunk of code in TS

    // XXX I really don't think that this is a good idea. We should be setting this a some finer granularity,
    // possibly per SSL CTX. httpd uses md5(host:port), which seems reasonable.
    session_id_context = 1;
    SSL_CTX_set_session_id_context(ctx, (const unsigned char *) &session_id_context, sizeof(session_id_context));

This is 100% broken and needs to be fixed. I believe [e-mail] raised concerns about this in the past, after reading OpenSSL documentation this is completely broken.