mirrors/uquic
1
0
Fork 0
mirror of https://github.com/refraction-networking/uquic.git synced 2025-04-03 20:27:35 +03:00
Code Issues Projects Releases Packages Wiki Activity

qtls: protect the tls.ClientSessionCache implementation with a mutex (#4319)

Browse source 
This prevents a race condition when the underlying ClientSessionCache
provided by the application returns the same session ticket for multiple
connections. Reusing session tickets is explicitly recommended against
by both RFC 8446 and RFC 9001, but it's not forbidden. This fix only
benefits applications that compromise their users' privacy by reusing
session tickets.
This commit is contained in:
Marten Seemann 2024-02-09 22:47:28 +07:00 • committed by GitHub
parent 4790797b58
commit 284996e13c
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 10 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

12
internal/qtls/client_session_cache.go
View file

@ -2,9 +2,11 @@ package qtls
import ( import (
"crypto/tls" "crypto/tls"
"sync"
) )
type clientSessionCache struct { type clientSessionCache struct {
mx sync.Mutex
getData func(earlyData bool) []byte getData func(earlyData bool) []byte
setData func(data []byte, earlyData bool) (allowEarlyData bool) setData func(data []byte, earlyData bool) (allowEarlyData bool)
wrapped tls.ClientSessionCache wrapped tls.ClientSessionCache
@ -12,7 +14,10 @@ type clientSessionCache struct {
var _ tls.ClientSessionCache = &clientSessionCache{} var _ tls.ClientSessionCache = &clientSessionCache{}
func (c clientSessionCache) Put(key string, cs *tls.ClientSessionState) { func (c *clientSessionCache) Put(key string, cs *tls.ClientSessionState) {
c.mx.Lock()
defer c.mx.Unlock()
if cs == nil { if cs == nil {
c.wrapped.Put(key, nil) c.wrapped.Put(key, nil)
return return
@ -32,7 +37,10 @@ func (c clientSessionCache) Put(key string, cs *tls.ClientSessionState) {
c.wrapped.Put(key, newCS) c.wrapped.Put(key, newCS)
} }
func (c clientSessionCache) Get(key string) (*tls.ClientSessionState, bool) { func (c *clientSessionCache) Get(key string) (*tls.ClientSessionState, bool) {
c.mx.Lock()
defer c.mx.Unlock()
cs, ok := c.wrapped.Get(key) cs, ok := c.wrapped.Get(key)
if !ok || cs == nil { if !ok || cs == nil {
return cs, ok return cs, ok