francis.wang
4c86c082a2
Combine poky (Yocto scarthgap), meta-openembedded (scarthgap), and meta-openwrt into a single repository. Components: - poky/ Yocto core framework (BitBake + OE-Core) - meta-openembedded/ Community layers (meta-oe, meta-python, meta-networking) - meta-openwrt/ OpenWrt customization layer - setup-env.sh One-click build environment setup - README.md Project documentation
49 lines
1.6 KiB
Diff
49 lines
1.6 KiB
Diff
From 78f581487706f2e43eea5a060c516fc4d98090e8 Mon Sep 17 00:00:00 2001
|
|
From: Sergey Kandaurov <pluknet@nginx.com>
|
|
Date: Tue, 17 Mar 2026 19:20:03 +0400
|
|
Subject: [PATCH] Stream: fixed client certificate validation with OCSP.
|
|
|
|
Check for OCSP status was missed in 581cf2267, resulting
|
|
in a broken validation.
|
|
|
|
Reported by Mufeed VH of Winfunc Research.
|
|
|
|
CVE: CVE-2026-28755
|
|
Upstream-Status: Backport [https://github.com/nginx/nginx/commit/78f581487706f2e43eea5a060c516fc4d98090e8]
|
|
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
|
|
---
|
|
src/stream/ngx_stream_ssl_module.c | 10 ++++++++++
|
|
1 file changed, 10 insertions(+)
|
|
|
|
diff --git a/src/stream/ngx_stream_ssl_module.c b/src/stream/ngx_stream_ssl_module.c
|
|
index 6dee106..9357d09 100644
|
|
--- a/src/stream/ngx_stream_ssl_module.c
|
|
+++ b/src/stream/ngx_stream_ssl_module.c
|
|
@@ -342,6 +342,7 @@ ngx_stream_ssl_handler(ngx_stream_session_t *s)
|
|
long rc;
|
|
X509 *cert;
|
|
ngx_int_t rv;
|
|
+ const char *str;
|
|
ngx_connection_t *c;
|
|
ngx_stream_ssl_srv_conf_t *sscf;
|
|
|
|
@@ -392,6 +393,15 @@ ngx_stream_ssl_handler(ngx_stream_session_t *s)
|
|
|
|
X509_free(cert);
|
|
}
|
|
+
|
|
+ if (ngx_ssl_ocsp_get_status(c, &str) != NGX_OK) {
|
|
+ ngx_log_error(NGX_LOG_INFO, c->log, 0,
|
|
+ "client SSL certificate verify error: %s", str);
|
|
+
|
|
+ ngx_ssl_remove_cached_session(c->ssl->session_ctx,
|
|
+ (SSL_get0_session(c->ssl->connection)));
|
|
+ return NGX_ERROR;
|
|
+ }
|
|
}
|
|
|
|
return NGX_OK;
|
|
--
|
|
2.50.1
|
|
|