From bb13a3bc761e794863a3e6a99b4ef588348c5871 Mon Sep 17 00:00:00 2001 From: yhirose Date: Fri, 16 Oct 2026 23:52:15 -0400 Subject: [PATCH] Rotate ticket keys of the size BoringSSL and LibreSSL take update_server_client_ca() rotated the session ticket keys with 80 bytes, which only OpenSSL takes. BoringSSL and LibreSSL take 48, refused them, and the result was not checked, so a client went on resuming with a ticket from before the client CA changed. Use the size each library takes, and fail the update when the keys cannot be set. --- httplib.h | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-) diff --git a/httplib.h b/httplib.h index f22845a1..4611aee8 100644 --- a/httplib.h +++ b/httplib.h @@ -20441,6 +20441,20 @@ inline bool update_server_client_ca(ctx_t ctx, const char *ca_pem) { auto store = create_ca_store(ca_pem, strlen(ca_pem)); if (!store) { return false; } + // A resumed session is not verified again, so the ticket keys from before + // go, or a client verified under the old CAs could go on resuming. +#if defined(OPENSSL_IS_BORINGSSL) || defined(LIBRESSL_VERSION_NUMBER) + unsigned char ticket_keys[48]; +#else + unsigned char ticket_keys[80]; +#endif + if (RAND_bytes(ticket_keys, sizeof(ticket_keys)) != 1 || + SSL_CTX_set_tlsext_ticket_keys(ssl_ctx, ticket_keys, + sizeof(ticket_keys)) != 1) { + free_ca_store(store); + return false; + } + // SSL_CTX_set_cert_store takes ownership SSL_CTX_set_cert_store(ssl_ctx, static_cast(store)); @@ -20451,18 +20465,12 @@ inline bool update_server_client_ca(ctx_t ctx, const char *ca_pem) { SSL_CTX_set_client_CA_list(ssl_ctx, ca_list); } - // A resumed session is not verified again, so forget the sessions and the - // ticket keys from before, or a client verified under the old CAs could go - // on resuming. + // The cached sessions go for the same reason. #if OPENSSL_VERSION_NUMBER >= 0x30400000L SSL_CTX_flush_sessions_ex(ssl_ctx, (std::numeric_limits::max)()); #else SSL_CTX_flush_sessions(ssl_ctx, (std::numeric_limits::max)()); #endif - unsigned char ticket_keys[80]; - if (RAND_bytes(ticket_keys, sizeof(ticket_keys)) == 1) { - SSL_CTX_set_tlsext_ticket_keys(ssl_ctx, ticket_keys, sizeof(ticket_keys)); - } return true; }