mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-17 20:19:29 +00:00
Marius Ciepluch
0116f9bea6
Harvest 176 isolated vuln-vs-fix functions (109 CVEs, 352 training rows) into benchmarks/pairs/vfc with provenance and a JSONL training manifest. Score the slice as an honesty dashboard (ousast pairs --slice vfc); keep the pair gate on the local fixtures only.
84 lines
3.4 KiB
C
84 lines
3.4 KiB
C
/* Provenance: openssl/openssl ssl_update_cache (fixed).
|
|
* repo: openssl/openssl
|
|
* commit: b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d
|
|
* parent: c1e462ee4bd61867ee391fc13110ca41e4889535
|
|
* commit_url: https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d
|
|
* cve: CVE-2024-2511
|
|
* license: Apache-2.0
|
|
* function: ssl_update_cache
|
|
* relpath: ssl/ssl_lib.c
|
|
*/
|
|
|
|
void ssl_update_cache(SSL *s, int mode)
|
|
{
|
|
int i;
|
|
|
|
/*
|
|
* If the session_id_length is 0, we are not supposed to cache it, and it
|
|
* would be rather hard to do anyway :-). Also if the session has already
|
|
* been marked as not_resumable we should not cache it for later reuse.
|
|
*/
|
|
if (s->session->session_id_length == 0 || s->session->not_resumable)
|
|
return;
|
|
|
|
/*
|
|
* If sid_ctx_length is 0 there is no specific application context
|
|
* associated with this session, so when we try to resume it and
|
|
* SSL_VERIFY_PEER is requested to verify the client identity, we have no
|
|
* indication that this is actually a session for the proper application
|
|
* context, and the *handshake* will fail, not just the resumption attempt.
|
|
* Do not cache (on the server) these sessions that are not resumable
|
|
* (clients can set SSL_VERIFY_PEER without needing a sid_ctx set).
|
|
*/
|
|
if (s->server && s->session->sid_ctx_length == 0
|
|
&& (s->verify_mode & SSL_VERIFY_PEER) != 0)
|
|
return;
|
|
|
|
i = s->session_ctx->session_cache_mode;
|
|
if ((i & mode) != 0
|
|
&& (!s->hit || SSL_IS_TLS13(s))) {
|
|
/*
|
|
* Add the session to the internal cache. In server side TLSv1.3 we
|
|
* normally don't do this because by default it's a full stateless ticket
|
|
* with only a dummy session id so there is no reason to cache it,
|
|
* unless:
|
|
* - we are doing early_data, in which case we cache so that we can
|
|
* detect replays
|
|
* - the application has set a remove_session_cb so needs to know about
|
|
* session timeout events
|
|
* - SSL_OP_NO_TICKET is set in which case it is a stateful ticket
|
|
*/
|
|
if ((i & SSL_SESS_CACHE_NO_INTERNAL_STORE) == 0
|
|
&& (!SSL_IS_TLS13(s)
|
|
|| !s->server
|
|
|| (s->max_early_data > 0
|
|
&& (s->options & SSL_OP_NO_ANTI_REPLAY) == 0)
|
|
|| s->session_ctx->remove_session_cb != NULL
|
|
|| (s->options & SSL_OP_NO_TICKET) != 0))
|
|
SSL_CTX_add_session(s->session_ctx, s->session);
|
|
|
|
/*
|
|
* Add the session to the external cache. We do this even in server side
|
|
* TLSv1.3 without early data because some applications just want to
|
|
* know about the creation of a session and aren't doing a full cache.
|
|
*/
|
|
if (s->session_ctx->new_session_cb != NULL) {
|
|
SSL_SESSION_up_ref(s->session);
|
|
if (!s->session_ctx->new_session_cb(s, s->session))
|
|
SSL_SESSION_free(s->session);
|
|
}
|
|
}
|
|
|
|
/* auto flush every 255 connections */
|
|
if ((!(i & SSL_SESS_CACHE_NO_AUTO_CLEAR)) && ((i & mode) == mode)) {
|
|
TSAN_QUALIFIER int *stat;
|
|
|
|
if (mode & SSL_SESS_CACHE_CLIENT)
|
|
stat = &s->session_ctx->stats.sess_connect_good;
|
|
else
|
|
stat = &s->session_ctx->stats.sess_accept_good;
|
|
if ((ssl_tsan_load(s->session_ctx, stat) & 0xff) == 0xff)
|
|
SSL_CTX_flush_sessions(s->session_ctx, (unsigned long)time(NULL));
|
|
}
|
|
}
|