wbrawner/openssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add a TLS version consistency check during session resumption

Browse source 
This is a temporary fix for while we are still using the old session
resumption logic in the TLSv1.3 code. Due to differences in EXTMS support
we can't resume a <=TLSv1.2 session in a TLSv1.3 connection (the EXTMS
consistency check causes the connection to abort). This causes test
failures.

Ultimately we will rewrite the session resumption logic for TLSv1.3 so this
problem will go away. But until then we need a quick fix to keep the tests
happy.

Reviewed-by: Rich Salz <rsalz@openssl.org>
This commit is contained in:
Matt Caswell 2016-11-03 15:05:27 +00:00
parent d7c42d71ba
commit c87386a2cd
1 changed files with 17 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
ssl/ssl_sess.c
View file

@ -588,6 +588,23 @@ int ssl_get_prev_session(SSL *s, CLIENTHELLO_MSG *hello)
goto err;
}
/*
* TODO(TLS1.3): This is temporary, because TLSv1.3 resumption is completely
* different. For now though we're still using the old resumption logic, so
* to avoid test failures we need this. Remove this code!
*
* Check TLS version consistency. We can't resume <=TLSv1.2 session if we
* have negotiated TLSv1.3, and vice versa.
*/
if (!SSL_IS_DTLS(s)
&& ((ret->ssl_version <= TLS1_2_VERSION
&& s->version >=TLS1_3_VERSION)
|| (ret->ssl_version >= TLS1_3_VERSION
&& s->version <= TLS1_2_VERSION))) {
/* Continue but do not resume */
goto err;
}
/* Check extended master secret extension consistency */
if (ret->flags & SSL_SESS_FLAG_EXTMS) {
/* If old session includes extms, but new does not: abort handshake */