[rpms/trafficserver] trafficserver-9.2.14-1: Merge branch 'master' of ssh://pkgs.fedoraproject.org/trafficserver

[rpms/trafficserver] trafficserver-9.2.14-1: Merge branch 'master' of ssh://pkgs.fedoraproject.org/trafficserver

[Jan-Frode Myklebust]

            A new commit has been pushed.

            Repo   : rpms/trafficserver
            Branch : trafficserver-9.2.14-1
            Commit : dd7ae9263377f70e08263e7512ba8641548b2886
            Author : Jan-Frode Myklebust <janfrode@tanso.net>
            Date   : 2012-08-16T10:43:02+02:00
            Stats  : +90/-0 in 2 file(s)
            URL    : https://src.fedoraproject.org/rpms/trafficserver/c/dd7ae9263377f70e08263e7512ba8641548b2886?branch=trafficserver-9.2.14-1

            Log:
            Merge branch 'master' of ssh://pkgs.fedoraproject.org/trafficserver

Conflicts:
	trafficserver.spec

---
diff --git a/trafficserver.spec b/trafficserver.spec
index 49ad7d8..2c8c79b 100644
--- a/trafficserver.spec
+++ b/trafficserver.spec
@@ -194,9 +194,13 @@ header files, and Apache httpd style module build system.
 %attr(0644,root,root) %{_libdir}/trafficserver/*.so
 
 %changelog
+
 * Thu Aug 16 2012 Jan-Frode Myklebust <janfrode@tanso.net> - 3.2.0-3
 - Add patch for TS-1392, to fix problem with SNI fallback.
 
+* Sun Jul 22 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 3.2.0-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
+
 * Mon Jun 25 2012 Jan-Frode Myklebust <janfrode@tanso.net> - 3.2.0-2
 - Remove duplicate man-pages.
 

diff --git a/0001-TS-1392-Fix-SNI-certificate-fallback-path.patch b/0001-TS-1392-Fix-SNI-certificate-fallback-path.patch
new file mode 100644
index 0000000..439a4dc
--- /dev/null
+++ b/0001-TS-1392-Fix-SNI-certificate-fallback-path.patch
@@ -0,0 +1,79 @@
+From 5ec4fb5eff9f5c1e2dc82e187bdd8d5f02080512 Mon Sep 17 00:00:00 2001
+From: James Peach <jpeach@apache.org>
+Date: Mon, 6 Aug 2012 20:42:43 -0700
+Subject: [PATCH] TS-1392: Fix SNI certificate fallback path
+
+When the SNI lookup fails, we fall back to a bad default SSL context
+instead of the context that we selected when we accepted the TCP
+connection. Make sure that we don't clobber a SSL context if the
+SNI lookup fails.
+---
+ iocore/net/SSLCertLookup.cc     |    7 -------
+ iocore/net/SSLNetVConnection.cc |   17 ++++++++++++++---
+ 2 files changed, 14 insertions(+), 10 deletions(-)
+
+index 8c323a5..8438ef2 100644
+--- a/iocore/net/SSLCertLookup.cc
++++ b/iocore/net/SSLCertLookup.cc
+@@ -113,13 +113,6 @@ SSLCertLookup::init(SslConfigParams * p)
+ {
+   param = p;
+   multipleCerts = buildTable();
+-
+-  // If there wasn't a default SSL context, make a default one. We need this to bootstrap
+-  // the SNI process and also to avoid crashing (which is generaly frowned upon).
+-  if (!this->ssl_default) {
+-    // XXX this leaks, but we're a singleton, so ....
+-    this->ssl_default = SSL_CTX_new(SSLv23_server_method());
+-  }
+ }
+ 
+ bool
+diff --git a/iocore/net/SSLNetVConnection.cc b/iocore/net/SSLNetVConnection.cc
+index e9372e9..fd89cba 100644
+--- a/iocore/net/SSLNetVConnection.cc
++++ b/iocore/net/SSLNetVConnection.cc
+@@ -46,6 +46,8 @@ ClassAllocator<SSLNetVConnection> sslNetVCAllocator("sslNetVCAllocator");
+ // Private
+ //
+ 
++static SSL_CTX * ssl_default = SSL_CTX_new(SSLv23_server_method());
++
+ #if TS_USE_TLS_SNI
+ 
+ static int
+@@ -65,12 +67,18 @@ ssl_servername_callback(SSL * ssl, int * ad, void * arg)
+     ctx = lookup->defaultContext();
+   }
+ 
+-  if (ctx == NULL) {
+-    return SSL_TLSEXT_ERR_NOACK;
++  if (ctx != NULL) {
++    SSL_set_SSL_CTX(ssl, ctx);
+   }
+ 
++  // At this point, we might have updated ctx based on the SNI lookup, or we might still have the
++  // original SSL context that we set when we accepted the connection.
++  ctx = SSL_get_SSL_CTX(ssl);
+   Debug("ssl", "found SSL context %p for requested name '%s'", ctx, servername);
+-  SSL_set_SSL_CTX(ssl, ctx);
++
++  if (ctx == NULL) {
++    return SSL_TLSEXT_ERR_NOACK;
++  }
+ 
+   // We need to return one of the SSL_TLSEXT_ERR constants. If we return an
+   // error, we can fill in *ad with an alert code to propgate to the
+@@ -495,6 +503,9 @@ SSLNetVConnection::sslStartHandShake(int event, int &err)
+       if (ctx == NULL) {
+         ctx = sslCertLookup.defaultContext();
+       }
++      if (ctx == NULL) {
++        ctx = ssl_default;
++      }
+ 
+ #if TS_USE_TLS_SNI
+       Debug("ssl", "setting SNI callbacks with initial ctx %p", ctx);
+-- 
+1.7.1
+

diff --git a/trafficserver.spec b/trafficserver.spec
index 5f13a89..2c8c79b 100644
--- a/trafficserver.spec
+++ b/trafficserver.spec
@@ -29,6 +29,8 @@ Requires(postun): initscripts
 
 Patch2:		trafficserver-init_scripts.patch
 Patch7:		trafficserver_make_install.patch
+# TS-1392, scheduled to be fixed in next minor release.
+Patch8:		0001-TS-1392-Fix-SNI-certificate-fallback-path.patch
 
 
 %description
@@ -40,6 +42,7 @@ caching proxy server.
 
 %patch2 -p1 -b .patch2
 %patch7 -p1 -b .patch7
+%patch8 -p1 -b .patch8
 
 %build
 ./configure --enable-layout=Gentoo --libdir=%{_libdir}/trafficserver --with-tcl=%{_libdir} --with-user=ats --with-group=ats
@@ -191,6 +194,10 @@ header files, and Apache httpd style module build system.
 %attr(0644,root,root) %{_libdir}/trafficserver/*.so
 
 %changelog
+
+* Thu Aug 16 2012 Jan-Frode Myklebust <janfrode@tanso.net> - 3.2.0-3
+- Add patch for TS-1392, to fix problem with SNI fallback.
+
 * Sun Jul 22 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 3.2.0-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild