File Generate-stateless-session-ID-just-after-the-ti... of Package compat-openssl098.1339

Overview Repositories Revisions Requests Users Attributes Meta

File Generate-stateless-session-ID-just-after-the-ticket-is-r.patch of Package compat-openssl098.1339

From 036b3f331bc530d8749916dd673bc07d687f0d00 Mon Sep 17 00:00:00 2001
From: "Dr. Stephen Henson" <steve@openssl.org>
Date: Fri, 30 Oct 2009 14:06:18 +0000
Subject: [PATCH] Generate stateless session ID just after the ticket is
 received instead of when a session is loaded. This will mean that
 applications that just hold onto SSL_SESSION structures and never call
 d2i_SSL_SESSION() will still work.

SUSE: the one missing hunk from this commit is already included in
enable-security-renegotiation.patch
---
 ssl/s3_clnt.c  | 23 ++++++++++++++++++++++-
 ssl/ssl_asn1.c | 26 --------------------------
 2 files changed, 22 insertions(+), 27 deletions(-)

Index: openssl-0.9.8j/ssl/ssl_asn1.c
===================================================================
--- openssl-0.9.8j.orig/ssl/ssl_asn1.c	2014-10-22 17:17:37.902324691 +0200
+++ openssl-0.9.8j/ssl/ssl_asn1.c	2014-10-22 17:34:27.909772393 +0200
@@ -199,12 +199,6 @@ int i2d_SSL_SESSION(SSL_SESSION *in, uns
                 a.tlsext_tick.length= in->tlsext_ticklen;
                 a.tlsext_tick.type=V_ASN1_OCTET_STRING;
                 a.tlsext_tick.data=(unsigned char *)in->tlsext_tick;
-		/* If we have a ticket set session ID to empty because
-		 * it will be bogus. If liftime hint is -1 treat as a special
-		 * case because the session is being used as a container
-		 */
-		if (in->tlsext_ticklen && (in->tlsext_tick_lifetime_hint != -1))
-			a.session_id.length=0;
                 }
 	if (in->tlsext_tick_lifetime_hint > 0)
 		{
@@ -478,26 +472,6 @@ SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION
 		ret->tlsext_ticklen = os.length;
  		os.data = NULL;
  		os.length = 0;
-		/* There are two ways to detect a resumed ticket sesion.
-		 * One is to set a random session ID and then the server
-		 * must return a match in ServerHello. This allows the normal
-		 * client session ID matching to work and we know much 
-		 * earlier that the ticket has been accepted.
-		 * 
-		 * The other way is to set zero length session ID when the
-		 * ticket is presented and rely on the handshake to determine
-		 * session resumption.
-		 */ 
-		if (ret->session_id_length == 0)
-			{
-			EVP_Digest(ret->tlsext_tick, ret->tlsext_ticklen, 
-				   ret->session_id, &ret->session_id_length,
-#ifndef OPENSSL_NO_SHA256
-					EVP_sha256(), NULL);
-#else
-					EVP_sha1(), NULL);
-#endif
-			}
  		}
 	else
 		ret->tlsext_tick=NULL;

Places

File Generate-stateless-session-ID-just-after-the-ticket-is-r.patch of Package compat-openssl098.1339

Places