On 04/08/15 22:03, Ian McFadries (imcfadri) wrote: > Sorry for the delayed response, I was away for a week and was able to test > the fix today. > > The fix did resolve the session ticket issue that I was encountering. > However, now I get an error when I am not using the session tickets under the > following conditions. I am continuing to investigate. > > Create an SSL Session using the context that negotiates the highest available > version > Client hello requests TLS 1.2 > Server responds with server hello using TLS 1.0 > Complete handshake with no problems > Disconnect session > Start new session which attempts a fast session resumption > Client sends Alert 70 (SSL_AD_PROTOCOLVERSION) because SSL struct version > contains version 0x303 but message after first message contains version 0x301
Oh. Try this additional patch. By moving the session creation earlier in the process the session protocol version gets fixed at that earlier point. Unfortunately we have moved it to a point *before* version negotiation has completed. This patch just updates the session version once version negotiation is finished. Matt
>From f4aa6b44a3a013726ca61fecfee8b3494be28f12 Mon Sep 17 00:00:00 2001 From: Matt Caswell <[email protected]> Date: Wed, 5 Aug 2015 13:33:52 +0100 Subject: [PATCH] Fix session resumption Commit f0348c842e7 introduced a problem with session resumption. The version for the session is fixed when the session is created. By moving the creation of the session earlier in the process the version is fixed *before* version negotiation has completed when processing the ServerHello on the client side. This fix updates the session version after version neg has completed. --- ssl/s23_clnt.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ssl/s23_clnt.c b/ssl/s23_clnt.c index acbbe31..f782010 100644 --- a/ssl/s23_clnt.c +++ b/ssl/s23_clnt.c @@ -736,6 +736,8 @@ static int ssl23_get_server_hello(SSL *s) goto err; } + s->session->ssl_version = s->version; + /* ensure that TLS_MAX_VERSION is up-to-date */ OPENSSL_assert(s->version <= TLS_MAX_VERSION); -- 2.1.4
_______________________________________________ openssl-dev mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-dev
