Re: [openssl.org #3129] AutoReply: Openssl not clearing session ticket upon handshake failure

[John Gardiner Myers via RT]

My proposed fix does not work. It isn't legitimate to just remove the 
session.

An updated proposed fix is attached.



diff -ru ../openssl-1.0.1e-orig/apps/s_client.c ./apps/s_client.c
--- ../openssl-1.0.1e-orig/apps/s_client.c      2013-02-11 07:26:04.000000000 
-0800
+++ ./apps/s_client.c   2013-09-16 10:43:51.589324000 -0700
@@ -1891,6 +1891,12 @@
                print_stuff(bio_c_out,con,full_log);
        SSL_shutdown(con);
        SHUTDOWN(SSL_get_fd(con));
+       if (reconnect)
+               {
+               reconnect--;
+               BIO_printf(bio_c_out,"reconnect\n");
+               goto re_start;
+               }
 end:
        if (con != NULL)
                {
diff -ru ../openssl-1.0.1e-orig/ssl/s3_clnt.c ./ssl/s3_clnt.c
--- ../openssl-1.0.1e-orig/ssl/s3_clnt.c        2013-02-11 07:26:04.000000000 
-0800
+++ ./ssl/s3_clnt.c     2013-09-17 15:56:53.531223000 -0700
@@ -646,6 +646,11 @@
                BUF_MEM_free(buf);
        if (cb != NULL)
                cb(s,SSL_CB_CONNECT_EXIT,ret);
+       if (ret < 0 && s->session != NULL)
+               {
+               SSL_CTX_remove_session(s->ctx,s->session);
+               s->new_session=1;
+               }
        return(ret);
        }