diff options
author | Emilia Kasper <emilia@openssl.org> | 2014-10-28 17:35:59 +0100 |
---|---|---|
committer | Emilia Kasper <emilia@openssl.org> | 2014-10-28 17:41:49 +0100 |
commit | 9bdedec0cf37b923024377c0280a1c134e9c49c6 (patch) | |
tree | 5e1faff75760eba97ab97943208b54f9a355e12b /ssl/ssl_sess.c | |
parent | f63fa8b10a08fcd344f08df16b43c19dadb17055 (diff) |
Tighten session ticket handling
Tighten client-side session ticket handling during renegotiation:
ensure that the client only accepts a session ticket if the server sends
the extension anew in the ServerHello. Previously, a TLS client would
reuse the old extension state and thus accept a session ticket if one was
announced in the initial ServerHello.
Reviewed-by: Bodo Moeller <bodo@openssl.org>
(cherry picked from commit d663df2399d1d9d6015bcfd2ec87b925ea3558a2)
Conflicts:
CHANGES
Diffstat (limited to 'ssl/ssl_sess.c')
-rw-r--r-- | ssl/ssl_sess.c | 16 |
1 files changed, 15 insertions, 1 deletions
diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c index ad40fadd02..235f92d824 100644 --- a/ssl/ssl_sess.c +++ b/ssl/ssl_sess.c @@ -335,7 +335,21 @@ int ssl_get_new_session(SSL *s, int session) return(0); } #ifndef OPENSSL_NO_TLSEXT - /* If RFC4507 ticket use empty session ID */ + /* + * If RFC5077 ticket, use empty session ID (as server). + * Note that: + * (a) ssl_get_prev_session() does lookahead into the + * ClientHello extensions to find the session ticket. + * When ssl_get_prev_session() fails, s3_srvr.c calls + * ssl_get_new_session() in ssl3_get_client_hello(). + * At that point, it has not yet parsed the extensions, + * however, because of the lookahead, it already knows + * whether a ticket is expected or not. + * + * (b) s3_clnt.c calls ssl_get_new_session() before parsing + * ServerHello extensions, and before recording the session + * ID received from the server, so this block is a noop. + */ if (s->tlsext_ticket_expected) { ss->session_id_length = 0; |