From d23934efb8e7adaa63d4eb5752505a40e4b1f285 Mon Sep 17 00:00:00 2001
From: reyk <>
Date: Fri, 16 Jan 2015 14:34:51 +0000
Subject: The SSL/TLS session Id context is limited to 32 bytes.  Instead of
 using the name of relayd relay or smtpd pki, use a 32 byte arc4random buffer
 that should be unique for the context.  This fixes an issue in OpenSMTPD when
 a long pki name could break the configuration.

OK gilles@ benno@
---
 src/lib/libtls/tls_server.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

(limited to 'src/lib')

diff --git a/src/lib/libtls/tls_server.c b/src/lib/libtls/tls_server.c
index 001f19ded4..514148bd93 100644
--- a/src/lib/libtls/tls_server.c
+++ b/src/lib/libtls/tls_server.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls_server.c,v 1.1 2014/10/31 13:46:17 jsing Exp $ */
+/* $OpenBSD: tls_server.c,v 1.2 2015/01/16 14:34:51 reyk Exp $ */
 /*
  * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
  *
@@ -51,6 +51,7 @@ int
 tls_configure_server(struct tls *ctx)
 {
 	EC_KEY *ecdh_key;
+	unsigned char sid[SSL_MAX_SSL_SESSION_ID_LENGTH];
 
 	if ((ctx->ssl_ctx = SSL_CTX_new(SSLv23_server_method())) == NULL) {
 		tls_set_error(ctx, "ssl context failure");
@@ -75,6 +76,17 @@ tls_configure_server(struct tls *ctx)
 		EC_KEY_free(ecdh_key);
 	}
 
+	/*
+	 * Set session ID context to a random value.  We don't support
+	 * persistent caching of sessions so it is OK to set a temporary
+	 * session ID context that is valid during run time.
+	 */
+	arc4random_buf(sid, sizeof(sid));
+	if (!SSL_CTX_set_session_id_context(ctx->ssl_ctx, sid, sizeof(sid))) {
+		tls_set_error(ctx, "failed to set session id context");
+		goto err;
+	}
+
 	return (0);
 
 err:
-- 
cgit v1.2.3-55-g6feb