• T
    Session resume broken switching contexts · a84e5c9a
    Todd Short 提交于
    When an SSL's context is swtiched from a ticket-enabled context to
    a ticket-disabled context in the servername callback, no session-id
    is generated, so the session can't be resumed.
    
    If a servername callback changes the SSL_OP_NO_TICKET option, check
    to see if it's changed to disable, and whether a session ticket is
    expected (i.e. the client indicated ticket support and the SSL had
    tickets enabled at the time), and whether we already have a previous
    session (i.e. s->hit is set).
    
    In this case, clear the ticket-expected flag, remove any ticket data
    and generate a session-id in the session.
    
    If the SSL hit (resumed) and switched to a ticket-disabled context,
    assume that the resumption was via session-id, and don't bother to
    update the session.
    
    Before this fix, the updated unit-tests in 06-sni-ticket.conf would
    fail test #4 (server1 = SNI, server2 = no SNI).
    Reviewed-by: NRich Salz <rsalz@openssl.org>
    Reviewed-by: NRichard Levitte <levitte@openssl.org>
    Reviewed-by: NMatt Caswell <matt@openssl.org>
    Reviewed-by: NPaul Dale <paul.dale@oracle.com>
    (Merged from https://github.com/openssl/openssl/pull/1529)
    a84e5c9a
ssl_sess.c 36.3 KB