diff options
| author | Matt Caswell <matt@openssl.org> | 2016-11-08 17:10:21 +0100 |
|---|---|---|
| committer | Matt Caswell <matt@openssl.org> | 2016-11-23 16:31:21 +0100 |
| commit | 9362c93ebc5b14bf18e82cdebf380ccc52f3d92f (patch) | |
| tree | b678e7fc85f02c32520c6aa9e3089d660d684121 /ssl | |
| parent | Fix EXTMS error introduced by commit 94ed2c6 (diff) | |
| download | openssl-9362c93ebc5b14bf18e82cdebf380ccc52f3d92f.tar.xz openssl-9362c93ebc5b14bf18e82cdebf380ccc52f3d92f.zip | |
Remove old style NewSessionTicket from TLSv1.3
TLSv1.3 has a NewSessionTicket message, but it is *completely* different to
the TLSv1.2 one and may as well have been called something else. This commit
removes the old style NewSessionTicket from TLSv1.3. We will have to add the
new style one back in later.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Diffstat (limited to 'ssl')
| -rw-r--r-- | ssl/statem/statem_clnt.c | 19 | ||||
| -rw-r--r-- | ssl/statem/statem_srvr.c | 9 | ||||
| -rw-r--r-- | ssl/t1_lib.c | 8 |
3 files changed, 8 insertions, 28 deletions
diff --git a/ssl/statem/statem_clnt.c b/ssl/statem/statem_clnt.c index f89d317ce7..0429e43ee7 100644 --- a/ssl/statem/statem_clnt.c +++ b/ssl/statem/statem_clnt.c @@ -136,12 +136,7 @@ static int ossl_statem_client13_read_transition(SSL *s, int mt) case TLS_ST_CR_SRVR_HELLO: if (s->hit) { - if (s->tlsext_ticket_expected) { - if (mt == SSL3_MT_NEWSESSION_TICKET) { - st->hand_state = TLS_ST_CR_SESSION_TICKET; - return 1; - } - } else if (mt == SSL3_MT_CHANGE_CIPHER_SPEC) { + if (mt == SSL3_MT_CHANGE_CIPHER_SPEC) { st->hand_state = TLS_ST_CR_CHANGE; return 1; } @@ -182,18 +177,6 @@ static int ossl_statem_client13_read_transition(SSL *s, int mt) break; case TLS_ST_CW_FINISHED: - if (s->tlsext_ticket_expected) { - if (mt == SSL3_MT_NEWSESSION_TICKET) { - st->hand_state = TLS_ST_CR_SESSION_TICKET; - return 1; - } - } else if (mt == SSL3_MT_CHANGE_CIPHER_SPEC) { - st->hand_state = TLS_ST_CR_CHANGE; - return 1; - } - break; - - case TLS_ST_CR_SESSION_TICKET: if (mt == SSL3_MT_CHANGE_CIPHER_SPEC) { st->hand_state = TLS_ST_CR_CHANGE; return 1; diff --git a/ssl/statem/statem_srvr.c b/ssl/statem/statem_srvr.c index 97ecbcd178..c8c31a3a67 100644 --- a/ssl/statem/statem_srvr.c +++ b/ssl/statem/statem_srvr.c @@ -419,8 +419,7 @@ static WRITE_TRAN ossl_statem_server13_write_transition(SSL *s) case TLS_ST_SW_SRVR_HELLO: if (s->hit) - st->hand_state = s->tlsext_ticket_expected - ? TLS_ST_SW_SESSION_TICKET : TLS_ST_SW_CHANGE; + st->hand_state = TLS_ST_SW_CHANGE; else st->hand_state = TLS_ST_SW_CERT; @@ -453,14 +452,10 @@ static WRITE_TRAN ossl_statem_server13_write_transition(SSL *s) ossl_statem_set_in_init(s, 0); return WRITE_TRAN_CONTINUE; } + st->hand_state = TLS_ST_SW_CHANGE; - st->hand_state = s->tlsext_ticket_expected ? TLS_ST_SW_SESSION_TICKET - : TLS_ST_SW_CHANGE; return WRITE_TRAN_CONTINUE; - case TLS_ST_SW_SESSION_TICKET: - st->hand_state = TLS_ST_SW_CHANGE; - return WRITE_TRAN_CONTINUE; case TLS_ST_SW_CHANGE: st->hand_state = TLS_ST_SW_FINISHED; diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c index 74022eeb2e..19853cae4a 100644 --- a/ssl/t1_lib.c +++ b/ssl/t1_lib.c @@ -943,7 +943,7 @@ int ssl_cipher_disabled(SSL *s, const SSL_CIPHER *c, int op) static int tls_use_ticket(SSL *s) { - if (s->options & SSL_OP_NO_TICKET) + if (s->options & SSL_OP_NO_TICKET || SSL_IS_TLS13(s)) return 0; return ssl_security(s, SSL_SECOP_TICKET, 0, 0, NULL); } @@ -2287,7 +2287,8 @@ static int ssl_scan_clienthello_tlsext(SSL *s, CLIENTHELLO_MSG *hello, int *al) } } #endif /* OPENSSL_NO_EC */ - else if (currext->type == TLSEXT_TYPE_session_ticket) { + else if (currext->type == TLSEXT_TYPE_session_ticket + && !SSL_IS_TLS13(s)) { if (s->tls_session_ticket_ext_cb && !s->tls_session_ticket_ext_cb(s, PACKET_data(&currext->data), @@ -3176,7 +3177,8 @@ int tls_get_ticket_from_client(SSL *s, CLIENTHELLO_MSG *hello, s->tlsext_ticket_expected = 0; /* - * If tickets disabled behave as if no ticket present to permit stateful + * If tickets disabled or not supported by the protocol version + * (e.g. TLSv1.3) behave as if no ticket present to permit stateful * resumption. */ if (s->version <= SSL3_VERSION || !tls_use_ticket(s)) |