Stowage/go
2
0
Fork 0
mirror of https://github.com/golang/go.git synced 2025-12-08 06:10:04 +00:00
Code Issues Projects Releases Packages Wiki Activity

crypto/tls: Never resume sessions across different versions.

Browse source 
Instead, decline the session and do a full handshake. The semantics of
cross-version resume are unclear, and all major client implementations
treat this as a fatal error. (This doesn't come up very much, mostly if
the client does the browser version fallback without sharding the
session cache.)

See BoringSSL's bdf5e72f50e25f0e45e825c156168766d8442dde and OpenSSL's
9e189b9dc10786c755919e6792e923c584c918a1.

Change-Id: I51ca95ac1691870dd0c148fd967739e2d4f58824
Reviewed-on: https://go-review.googlesource.com/21152
Reviewed-by: Adam Langley <agl@golang.org>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
This commit is contained in:
David Benjamin 2016-02-15 11:41:40 -05:00 • committed by Brad Fitzpatrick
parent d8bd7b24fc
commit ebbe4f8db7
2 changed files with 60 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

6
src/crypto/tls/handshake_server.go
View file

@ -284,10 +284,8 @@ func (hs *serverHandshakeState) checkForResumption() bool {
return false
}
if hs.sessionState.vers > hs.clientHello.vers {
return false
}
if vers, ok := c.config.mutualVersion(hs.sessionState.vers); !ok || vers != hs.sessionState.vers {
// Never resume a session for a different TLS version.
if c.vers != hs.sessionState.vers {
return false
}