Bug 1104597 - wrong re-use of a session cache entry
Summary: wrong re-use of a session cache entry
Status: CLOSED NEXTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: curl
Version: 22
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Kamil Dudka
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Keywords: Patch
Depends On:
Blocks: 1098711 1241172
TreeView+ depends on / blocked
 
Reported: 2014-06-04 10:04 UTC by Kamil Dudka
Modified: 2016-11-29 11:28 UTC (History)
11 users (show)

(edit)
Clone Of:
(edit)
Last Closed: 2015-09-21 10:47:27 UTC


Attachments (Terms of Use)
[PATCH] ssl: require server name to match in ssl_LookupSID() (997 bytes, patch)
2014-06-04 10:05 UTC, Kamil Dudka
no flags Details | Diff


External Trackers
Tracker ID Priority Status Summary Last Updated
Mozilla Foundation 1202264 None None None Never

Description Kamil Dudka 2014-06-04 10:04:31 UTC
Description of problem:
NSS re-uses a session cache entry despite the server name does not match, which causes SNI host name to differ from the actual host name.  Consequently, certain servers (as e.g. github.com) respond by 400 to such requests.


Version-Release number of selected component (if applicable):
nss-3.16.1-2.fc21


Steps to Reproduce:
1. curl -fL https://raw.github.com/teeedubb/teeedubb-xbmc-repo/master/addons.xml.md5


Actual results:
curl: (22) The requested URL returned error: 400 Bad Request


Expected results:
97c2bb53b388ad03329e273951407511


Additional info:
See bug 1098711 for details.

Comment 1 Kamil Dudka 2014-06-04 10:05:21 UTC
Created attachment 902122 [details]
[PATCH] ssl: require server name to match in ssl_LookupSID()

Comment 2 Nathan Salter 2014-09-30 08:00:15 UTC
I can confirm that this is also happening with libcurl 7.19.7 using NSS 3.15.3. 

When switching connection between two different hosts which share the same certificate (and probably IP), it will reuse the TLS handshake from the previous request which causes many server applications (such as Apache) to return a 400 error.

Interestingly enough it will continue to use the incorrect handshake even when the server returns non-200 responses. Tested using openssl fixes the issue with definitely implies that there's a problem with the NSS lib.

Example (PHP) code to replicate the issue: http://pastebin.com/K7JhCLsz

Comment 3 Jaroslav Reznik 2015-03-03 15:52:05 UTC
This bug appears to have been reported against 'rawhide' during the Fedora 22 development cycle.
Changing version to '22'.

More information and reason for this action is here:
https://fedoraproject.org/wiki/Fedora_Program_Management/HouseKeeping/Fedora22

Comment 4 Kamil Dudka 2015-08-06 09:35:33 UTC
Elio, have you had time to look at the patch for this bug I posted a year ago?

Comment 5 Elio Maldonado Batiz 2015-09-06 17:09:22 UTC
(In reply to Kamil Dudka from comment #4)
Sorry for the delay, as you can see I just filed an upstream bug with a pointer to your patch and we are already getting comments.

Comment 6 Kamil Dudka 2015-09-18 16:03:21 UTC
Mozilla upstream suggested a workaround for curl:

https://github.com/bagder/curl/commit/958d2ffb

I will put the patch into Fedora...

Comment 7 Kamil Dudka 2015-09-18 16:41:17 UTC
fixed in curl-7.44.0-2.fc24

Comment 8 Fedora Update System 2015-09-18 17:21:16 UTC
curl-7.43.0-4.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2015-16178

Comment 9 Fedora Update System 2015-09-19 00:20:27 UTC
curl-7.43.0-4.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report.\nIf you want to test the update, you can install it with \n su -c 'yum --enablerepo=updates-testing update curl'. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-16178

Comment 10 Fedora Update System 2015-09-19 02:20:47 UTC
curl-7.40.0-7.fc22 has been pushed to the Fedora 22 testing repository. If problems still persist, please make note of it in this bug report.\nIf you want to test the update, you can install it with \n su -c 'yum --enablerepo=updates-testing update curl'. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-16177

Comment 11 Fedora Update System 2015-09-21 10:47:20 UTC
curl-7.43.0-4.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

Comment 12 Benjamin Xiao 2015-09-22 01:46:28 UTC
I can confirm that curl-7.40.0-7.fc22 fixes the issues with owncloud complaining that it doesn't have an internet connection: Bug 1241172

Thanks for the fix

Comment 13 Fedora Update System 2015-09-22 22:53:32 UTC
curl-7.40.0-7.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.