Prevent race on SSL CTX - #488
Closed
bilias wants to merge 1 commit into
Closed
Conversation
Contributor
Author
|
New PR (#490) |
bilias
added a commit
to bilias/nsd
that referenced
this pull request
Jun 6, 2026
cert-bundle and tls-auth certs can be outside of chroot and loaded before priv drop. Can be owned by root only. Client SSL CTX moved out of xfrd_tcp_set struct into tls_auth_options struct. CTXs for tls-auth are created before chroot. tp pipeline uses that to create the SSL connections. This also fixes a race on SSL CTX. Details: NLnetLabs#488
bilias
added a commit
to bilias/nsd
that referenced
this pull request
Jun 6, 2026
cert-bundle and tls-auth certs can be outside of chroot and loaded before priv drop. Can be owned by root only. Client SSL CTX moved out of xfrd_tcp_set struct into tls_auth_options struct. CTXs for tls-auth are created before chroot. tp pipeline uses that to create the SSL connections. This also fixes a race on SSL CTX. Details: NLnetLabs#488
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
xfrd_tcp_open()currently loads the client certificate and private key into the global SSL_CTX (set->ssl_ctx) which is shared across all pipelines.This causes a race condition when multiple zones have different tls-auth definitions with different client certificates. Concurrent calls to
xfrd_tcp_open()can overwrite each other's certificate/key in the shared context, causing a pipeline to authenticate with the wrong identity or failSSL_check_private_key()due to a cert/key mismatch.Fix this by loading the private key/certificate directly into the per-pipeline SSL object (
tp->ssl)I've kept
SSL_CTX_set_default_passwd_cbandSSL_CTX_set_default_passwd_cb_userdataon the global CTX for now since LibreSSL that I use does not haveSSL_set_default_passwd_cbandSSL_set_default_passwd_cb_userdata. So we still have a race condition there that should be documented (use same password for all encrypted keys!)Ideally this should be solved by loading tls-auth early on startup before dropping privileges (see #363) and before chroot while keeping a different SSL_CTX per tls-auth.