openssl+sectrust: fix session reuse#22235
Closed
icing wants to merge 3 commits into
Closed
Conversation
Contributor
Author
|
I swear if the clankers recommend a test case for this, I'll get my M-25 Phased Plasma Pulse-Gun. |
bagder
approved these changes
Jul 1, 2026
There was a problem hiding this comment.
Pull request overview
This PR addresses OpenSSL session resumption failures when certificate verification is performed via Apple SecTrust (after OpenSSL verification fails with native CA store enabled). It does so by persisting “verified via SecTrust” state into curl’s session cache and allowing such sessions to be reused on subsequent connections.
Changes:
- Persist a
sectrust_verifiedflag inCurl_ssl_sessionand include it in session pack/unpack. - Track SecTrust verification state in the OpenSSL backend (
ossl_ctx) and propagate it into cached sessions. - Relax OpenSSL’s “do not reuse unverified sessions” check to permit reuse for sessions previously verified via SecTrust.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| lib/vtls/vtls_spack.c | Adds a new packed-session tag to serialize/deserialize SecTrust verification state. |
| lib/vtls/vtls_scache.h | Extends cached TLS session metadata with a sectrust_verified bit. |
| lib/vtls/openssl.h | Adds OpenSSL-backend state bits for SecTrust verification and whether a reused session was SecTrust-verified. |
| lib/vtls/openssl.c | Propagates SecTrust verification into session cache and permits reuse of SecTrust-verified sessions. |
| lib/vquic/cf-ngtcp2-cmn.c | Updates QUIC OpenSSL session callback to match the updated Curl_ossl_add_session signature. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
When TLS is verified via Apple SecTrust, openssl internal state is a verification faiure (that is how it works, we use sectrust when openssl fails to verify and natice ca store is enabled). OpenSSL stores this verification status inside its TLS session objects. On reuse, we see an unverified session and do not reuse it for a verified connect attempt. While this is a performance penalty for most connections, it *fails* on ftps:// transfers where servers expect session reuse on DATA connections. Fix this by remembering that TLS and a session was verified by sectrust and allow reuse of such sessions for new connect attempts that also use sectrust.
icing
force-pushed
the
sectrust-session-reuse-fix
branch
from
b824c8d to
db2624d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When TLS is verified via Apple SecTrust, openssl internal state is a verification faiure (that is how it works, we use sectrust when openssl fails to verify and natice ca store is enabled).
OpenSSL stores this verification status inside its TLS session objects. On reuse, we see an unverified session and do not reuse it for a verified connect attempt. While this is a performance penalty for most connections, it fails on ftps:// transfers where servers expect session reuse on DATA connections.
Fix this by remembering that TLS and a session was verified by sectrust and allow reuse of such sessions for new connect attempts that also use sectrust.