generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Correct reading back of tlsext_tick_lifetime_hint from ASN1.

Browse Source 
When writing out the hint, if the hint > 0, then we write it out otherwise
we skip it.

Previously when reading the hint back in, if were expecting to see one
(because the ticket length > 0), but it wasn't present then we set the hint
to -1, otherwise we set it to 0. This fails to set the hint to the same as
when it was written out.

The hint should never be negative because the RFC states the hint is
unsigned. It is valid for a server to set the hint to 0 (this means the
lifetime is unspecified according to the RFC). If the server set it to 0, it
should still be 0 when we read it back in.

Reviewed-by: Tim Hudson <tjh@openssl.org>
This commit is contained in:
Matt Caswell 2015-02-08 22:41:10 +00:00
parent f2baac27d5
commit ea6bd26454
1 changed files with 1 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
ssl/ssl_asn1.c
View File

@ -569,9 +569,7 @@ SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp,
OPENSSL_free(ai.data);
ai.data = NULL;
ai.length = 0;
} else if (ret->tlsext_ticklen && ret->session_id_length)
ret->tlsext_tick_lifetime_hint = -1;
else
} else
ret->tlsext_tick_lifetime_hint = 0;
os.length = 0;
os.data = NULL;