SSL: synced all session ticket keys to the worker process

The per-worker ticket key mirror is allocated with three slots
(ngx_array_push_n(keys, 3)), matching the shared memory
ticket_keys[3] array and the decrypt callback, which scans all
keys->nelts slots by key name.  Key rotation, however, synced
only two slots from shared memory, leaving the third slot's
name, hmac_key, and aes_key uninitialized.

A ticket whose key name matched the uninitialized slot (which
holds unspecified pool memory, all zero in the best case) could
therefore be HMAC-verified and decrypted with uninitialized key
material, allowing a forged session.

Sync all keys->nelts slots, as ngx_ssl_ticket_keys_cleanup()
already assumes.

Reported by PhiNode Labs.

diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
index e4250ee09fc4e6e44f91edfd12a70e31b6c09752..9b82364893c40b25aadc441a98c903831eeb3bcf 100644 (file)
--- a/src/event/ngx_event_openssl.c
+++ b/src/event/ngx_event_openssl.c
@@ -5251,7 +5251,7 @@ ngx_ssl_rotate_ticket_keys(SSL_CTX *ssl_ctx, ngx_log_t *log)
     /* sync keys to the worker process memory */
 
     ngx_memcpy(keys->elts, cache->ticket_keys,
-               2 * sizeof(ngx_ssl_ticket_key_t));
+               keys->nelts * sizeof(ngx_ssl_ticket_key_t));
 
     ngx_shmtx_unlock(&shpool->mutex);