From d3835d153a39e9105eb87676d68ccf1645100973 Mon Sep 17 00:00:00 2001 From: David Benjamin Date: Sat, 5 Mar 2016 19:35:52 -0500 Subject: [PATCH 3/7] The NewSessionTicket message is not optional. Per RFC 4507, section 3.3: This message [NewSessionTicket] MUST be sent if the server included a SessionTicket extension in the ServerHello. This message MUST NOT be sent if the server did not include a SessionTicket extension in the ServerHello. The presence of the NewSessionTicket message should be determined entirely from the ServerHello without probing. --- ssl/statem/statem_clnt.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/ssl/statem/statem_clnt.c b/ssl/statem/statem_clnt.c index b8ca82f..608aec8 100644 --- a/ssl/statem/statem_clnt.c +++ b/ssl/statem/statem_clnt.c @@ -345,9 +345,11 @@ int ossl_statem_client_read_transition(SSL *s, int mt) break; case TLS_ST_CW_FINISHED: - if (mt == SSL3_MT_NEWSESSION_TICKET && s->tlsext_ticket_expected) { - st->hand_state = TLS_ST_CR_SESSION_TICKET; - return 1; + if (s->tlsext_ticket_expected) { + if (mt == SSL3_MT_NEWSESSION_TICKET) { + st->hand_state = TLS_ST_CR_SESSION_TICKET; + return 1; + } } else if (mt == SSL3_MT_CHANGE_CIPHER_SPEC) { st->hand_state = TLS_ST_CR_CHANGE; return 1; -- 2.5.4 (Apple Git-61)