diff options
author | Xin LI <delphij@FreeBSD.org> | 2015-02-25 05:56:16 +0000 |
---|---|---|
committer | Xin LI <delphij@FreeBSD.org> | 2015-02-25 05:56:16 +0000 |
commit | 0099f6f89a1325dc504096aecbdcbddad498310e (patch) | |
tree | fb8622e587884d6798b247e77bf0a8dcc352eedd /crypto/openssl/ssl/ssl_sess.c | |
parent | 11ad446ce58488a8870294bee24ea87050e96dbe (diff) |
Notes
Diffstat (limited to 'crypto/openssl/ssl/ssl_sess.c')
-rw-r--r-- | crypto/openssl/ssl/ssl_sess.c | 16 |
1 files changed, 15 insertions, 1 deletions
diff --git a/crypto/openssl/ssl/ssl_sess.c b/crypto/openssl/ssl/ssl_sess.c index ad40fadd02cc..235f92d824cd 100644 --- a/crypto/openssl/ssl/ssl_sess.c +++ b/crypto/openssl/ssl/ssl_sess.c @@ -335,7 +335,21 @@ int ssl_get_new_session(SSL *s, int session) return(0); } #ifndef OPENSSL_NO_TLSEXT - /* If RFC4507 ticket use empty session ID */ + /* + * If RFC5077 ticket, use empty session ID (as server). + * Note that: + * (a) ssl_get_prev_session() does lookahead into the + * ClientHello extensions to find the session ticket. + * When ssl_get_prev_session() fails, s3_srvr.c calls + * ssl_get_new_session() in ssl3_get_client_hello(). + * At that point, it has not yet parsed the extensions, + * however, because of the lookahead, it already knows + * whether a ticket is expected or not. + * + * (b) s3_clnt.c calls ssl_get_new_session() before parsing + * ServerHello extensions, and before recording the session + * ID received from the server, so this block is a noop. + */ if (s->tlsext_ticket_expected) { ss->session_id_length = 0; |