kris/boringssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Honor SSL_SESS_CACHE_CLIENT in TLS 1.3.

Browse Source 
The new_session_cb callback should not be run if SSL_SESS_CACHE_CLIENT
is off.

Change-Id: I1ab320f33688f186b241d95c81775331a5c5b1a1
Reviewed-on: https://boringssl-review.googlesource.com/20065
Reviewed-by: Steven Valdez <svaldez@google.com>
Commit-Queue: Steven Valdez <svaldez@google.com>
CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
This commit is contained in:
David Benjamin 2017-09-06 16:12:52 -04:00 committed by CQ bot account: commit-bot@chromium.org
parent a861460c89
commit 3d8f0808e4
2 changed files with 14 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
ssl/ssl_test.cc
View File

@ -3102,6 +3102,18 @@ TEST_P(SSLVersionTest, GetServerName) {
SSL_get_servername(server_.get(), TLSEXT_NAMETYPE_host_name));
}
// Test that session cache mode bits are honored in the client session callback.
TEST_P(SSLVersionTest, ClientSessionCacheMode) {
SSL_CTX_set_session_cache_mode(client_ctx_.get(), SSL_SESS_CACHE_OFF);
EXPECT_FALSE(CreateClientSession(client_ctx_.get(), server_ctx_.get()));
SSL_CTX_set_session_cache_mode(client_ctx_.get(), SSL_SESS_CACHE_CLIENT);
EXPECT_TRUE(CreateClientSession(client_ctx_.get(), server_ctx_.get()));
SSL_CTX_set_session_cache_mode(client_ctx_.get(), SSL_SESS_CACHE_SERVER);
EXPECT_FALSE(CreateClientSession(client_ctx_.get(), server_ctx_.get()));
}
TEST(SSLTest, AddChainCertHack) {
// Ensure that we don't accidently break the hack that we have in place to
// keep curl and serf happy when they use an |X509| even after transfering

3
ssl/tls13_client.cc
View File

@ -839,7 +839,8 @@ int tls13_process_new_session_ticket(SSL *ssl, const SSLMessage &msg) {
session->ticket_age_add_valid = 1;
session->not_resumable = 0;
if (ssl->ctx->new_session_cb != NULL &&
if ((ssl->ctx->session_cache_mode & SSL_SESS_CACHE_CLIENT) &&
ssl->ctx->new_session_cb != NULL &&
ssl->ctx->new_session_cb(ssl, session.get())) {
// |new_session_cb|'s return value signals that it took ownership.
session.release();